iL£  coy  AD- A 149  248 


DOT/FAA/PM-S4/18 

Program  Engineering  Flight  Phase  Status 

and  Maintenance  Service  9 

Washington,  D  C.  20591 

Phase  I:  Systems  Concepts 


Monitor  Study 


Flight  Deck  Research 

Boeing  Commercial  Airplane  Company 

Seattle.  Washington,  9o  24 

Dougias  Aircraft  Company 

Lockheed  Aircraft  Company 

3J0CCO&3J31 

July  1934 

Fma-  Report,  Phase  I 


This  C<  is  available  to  the  public 

ih'our  i  ♦hj  National  Technical  Information 
b:  rv:o  Springfield.  Virginia  22181. 


i 

* 

K' 

h" 

K.’ 


l 


V 

r 


'Orl'.lfrnT 

plates:  /Cl  i Ur*  rsp”c,*irct«t 
loris  i?lll  fcc  ii;  m»l 

rh1V.» 


U  S  Department  of  Transportation 

Federal  Avkitlnn  Administratfon 


84  12  17  016 


1 


m~.  T'.i' 


J  (Tw  »~_I  «T5».  IT"-  *~-i.  »rv 


v. wj. *~i  rv  «rv  m-a  »r_  rr  f-  -*~u  "<V  »*i w"£‘* 


w 


NOTICES 

This  document  is  disseminated  under  the  sponsorship  of  the  Department  of 
Transportation  in  the  Interest  of  information  exchange.  The  United  States 
Government  assumes  no  liability  for  its  contents  or  use  thereof. 

The  United  States  Government  does  not  endorse  products  or  manufacturers. 

Treie  or  manufacturers'  names  appear  herein  solely  because  they  are  considered 
essential  to  the  object  of  this  report. 


« 

K 


*  5- 


Technical  Report  Documentation  Page 


1.  Revert  No. 


DCrr/FAA/Ptf-84/lP 


4.  Trtl«  one 


|  2.  ^c:tss>on  f*!o. 

I 


3'.  R«c:p-e^t  $  Cc^aiog  No 


5.  R.'oort  Da 


i  Flight'  Phase  Status  Monitor  Study:  Phase  I 
i  Systems  Concepts 


July  10,-1384 . 


t>.  P ng  Organ* zatior  Coa® 


7  At. 'nor  $■ 

L.  G.  Summers,  B.  L.  Berson,  D.  C.  Hanson,  C.  Rossi 


•  8.  P*'#0'»mng  Orgonixo»»on  K*oo»  No 


7  Par?orni*ig  Or;ar<:ar!c«  Nsmt  and  Address 

!  Flight  Deck  Research 
I  Boeing  Commercial  Airplane  Company 
!  P.O.  Box  3707,  Seattle,  WA  98124 
v Douglas  Aircraft  Company  -  Lockheed  Aircraft  Company 


!Q  Hq-k  Ji.t  No  ■  T  p 


I  I  -  Contract  or  G'onf  No. 

DTFA01-83-20033 


i  2.  ^P'‘«»ortri^  A-juncv  Nome  end  Ajd-ess 

U.S.  Department  of  Transportation 
Federal  Aviation  Administration 
800  Independence  Avenue,  S.W. 
Washington,  D.C.  20591 


•  •  3  *V'P®  o'  R*po»*  ond  P#'<od  Ca**'*^ 

|  Final  Report  Phase  I 
!  June  1983  -  July  1984 


/ 


{  15.  ;.joattm«nroiy  No'fi 


V- 


1  *4  Sponsoring  -^eney  Cos* 

APM-430 


/ 

^''  -^'7/,' '  ;  7: '  tcoc 


( 

I 

t 


jThis  report  covers  Phase  I  of  a  studjr^conducted  for  the  FAA  to  develop  flight  status 
monitor  concepts.  Previous  studies  of  crew  alerting  systems  suggested  the  concept  of  a 
;flight  status  moni tor £ which  could  monitor  a  flight,  alert  the  crew  to  abnormal  opera¬ 
tions  as  well  as  aircraft  system  failures,  and  guide  the  crew  through  the  appropriate 
.response-action  procedures.'NCandidate  concepts  developed  in  Phase  I  will  be  refined 
and  evaluated  in  Phase  II. 

(The  jiajor  Phase  I  activities  <^eperte^  include: 

jl.  Reviewing  the  results  of  Phase  IV  of  the  Aircraft  Alerting  System  Standardization  ! 
iStudy  to  Identify  the  requirements  for  expanding  the  alerting  system  into  an  FSM. 

2.  Developing  preliminary  FSM  candidate  concepts  and  identifying  design  issues  relating 
ito  concept  implementation.  ,  , 


|3.  Performing  a  literature  review  to  obtain  data  for  answering  design  questir^s. 

J4.  Developing  realistic  demonstration  scenarios,  based  upon  previous  accidents/  \  \ 

^incidents,  to  provide  a  mechanism  for  evaluating  the  candidate  concepts.  i 

5.  Implementing  the  FSM  concepts  and  demonstration  scenarios  in  a  flight  deck  simulator 

for  concept  demonstration/evaluation.  ! 

6.  Conducting  demonstrations  and  developing  a  questionnaire  to  solicit  pilot  comments/’ 

opinions  for  refining  the  candidate  concepts  and  to  provide  data  for  resolving  FSM  ! 
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PREFACE 


This  study  Is  sponsored  by  the  Federal  Aviation  Administration  and  Is 
directed  toward  the  Improvement  of  flight  crew  performance  through  the 
development  of  standardized  aircraft  alerting  systems  for  crew  alerting  and 
flight  status  monitoring.  Previous  studies  suggested  that  a  Flight,  Status 
Monitor  {FSM)  could  monitor  flight  status  for  abnormal  operations  as  well 
as  aircraft  system  failures  and  could  guide  the  crew  through  the  appro¬ 
priate  procedures  for  the  situation.  The  objective  of  this  study  Is  to 
develop  and  evaluate  FSM  concepts.  Phase  I,  conducted  between  June  1983 
and  July  1984,  consisted  of  developing  candidate  FSM  concepts,  while  Phase 
II  will  consist  of  refining  and  evaluating  those  concepts.  The  study  Is 
being  conducted  as  a  joint  effort  by  the  Boeing,  Douglas,  and  Lockheed 
Aircraft  Companies.  The  primary  purpose  of  this  report  Is  to  summarize  the 
results  of  Phase  I  activities. 

The  authors  wish  to  express  their  appreciation  for  the  assistance  received 
from  their  respective  engineering  and  safety  organizations.  The  assistance 
end  guidance  of  Wayne  D.  Smith,  the  r.ogram  Manager  and  Boeing  Flight 
Systems  Research  and  PD  Manager,  was  of  great  value.  The  efforts  of  the 
rest  of  the  Flight  Systems  In  fabricating  the  simulation  system  was  — 
Instrumental  In  the  success  of  the  project-  The  contract  sponsor  Is  the 
Federal  Aviation  Administration,  and  technical  guidance  was  provided  by 
John  F.  Hendrickson,  APM-430,  the  Contract  Monitor. 


1.0  INTRODUCTION 


1.1  PROGRAM  HISTORY 

The  study  of  aircraft  alerting  systems  and  flight  status  monitor  concepts 
was  Initiated  in  1973  when  the  Federal  Aviation  Administration  (FAA)  con¬ 
tracted  with  Boeing  to  study  independent  altitude  monitors.  Follow-up 
studies  conducted  during  1974  through  1977  Investigated  operational 
philosophies  for  implementing  effective  and  reliable  alerting  systems. 

Study  results  indicated  that  there  had  been  a  significant  increase  in  the 
number  of  alerting  signals  used  on  newer  commercial  transports  and  very 
little  standardization  had  been  used  by  the  airframe  manufacturers  In 
implementing  alerting  system  elements.  Table  1.1-1  summarizes  the  major 
activities  accomplished  during  these  studies. 

The  identification  of  these  problems  led  to  the  Aircraft  Alerting  Systems 
Standardization  Study  contract.  The  contract  was  performed  as  a  team 
effort  by  the  Boeing,  Lockheed  and  McDonnell  Douglas  aircraft  companies. 

The  study  was  to  have  been  conducted  In  three  phases  and  culminate  with  the 
development  of  design  guidelines  for  improving  and  standardizing  advanced 
aircraft  alerting  systems.  During  the  course  of  the  study  contract. 
Interest  was  developed  within  the  FAA  In  expanding  the  requirements  of  the 
alerting  system  to  monitor  flight  status  and  facilitate  crew  responses  to 
abnormal  and  emergency  situations.  A  contract  modification  was  made  to  add 
a  fourth  phase  to  review  accident  histories  and  the  cockpit  environment  to 
determine  concept  feasibility  of  a  Flight  Status  Monitor  (FSM). 

Table  1.1-2  lists-  the  major  activities  conducted  under  the  Aircraft  Alert¬ 
ing  Systems  Standardization  Study. 


Table  1.1-1  Early  Alerting  System  Studies  —  Contract  DOT-FA  73WA-3233 


Title 

(Report  No.) 

Development  of  an 
indepondent  attitude 
monitor  concept 
(FAA-RD-73-168) 

Independent  altitud . 
monitor  ~'-.ods 

and  modes  study 
(FAA-RD-75-86) 

Collation  and  analysis 
'  or  aircraft  alerting 
systems  data 
(FAA  RD-76-222) 

Objectives 

•  Identify  nature  of  typical 
inadvertent  terrain  impact 
accident  scenarios 

C  Identify  techniques  whereby 
inadvertent  terrain  impact 
accidents  might  be  reduced 

•  Identify  functional  elements 
of  an  independent  altitude 
monitor  concept 

•  Identify  methods  of 
implementing  independent 
monitor  systems 

•  Develop  operational  alert 
philosophy  and  concepts 

•  Demonstrate  and  refine 
selected  indopendent  altitude 
monitor  alerting  methods 

•  Develop  independent  altitude 
monitor  implementation  plan 

•  Tabulate  current  waiting 
methods  and  requirements 
for  all  cockpit  alerting 
functions 

•  Develop  method  for 
prioritizing  alerting 
functions 

•  Prioritize  alerting  functions 

•  Correlate  requirements  with 
prioritized  functions  and 
note  conflicts 

•  Broaden  stimuli-response 
data  base 

•  Define  tests  for  ecquiring 
stimuli-response  data  not 
available  in  literature  but 
required  for  designing 
alerting  systems 

•  Provide  recommendations  for 
standardization  of  alerting 
functions  and  methods 

Period 

February  1 973  to 

September  1 973 

June  1 974  to  July  1 975  1 

January  1976  to  May  1977 

Table  1.1-2  Aircraft  Alerting  Systems  Standardization  Study  — 
Contract  D0T-FA79WA  4268 


Title 

(Report  No.) 

Phase  1 

Defire  prototype 
alerting  system 
concepts 
(FAA-RD-80-68) 

Phase  II 

Plan  tests  for 
prototype  alerting 
system  concept 
evaluations 

Phase  III 

Evaluate  prototype 
alerting  system 
concepts 

(FAA-RD-81-38I&I1) 

Phase  IV 

Accident  implication 
for  system  design 
(DOT/FAA/HD-82-26) 

Objectives 

•  Acquire  missing  stimuli- 
response  data  via 
appropriate  simulator 
testa 

•  Define,  alerting  system 
concepts 

•  Asses  physical  chare  ter- , 
i sties  of  each  concept 

•  Assess  implementation 
feasibility  of  each 
concept 

•  Select  alerting  system 
concepts  for 
comparative 
evaluation 

•  Select  simulation  facility 

•  Develop  test  plan 

•  Coordinate  test  plan 
with  FAA 

•  Develop  brassboerd 
hardware  for  selected 
alerting  system  concepts 

•  Perform  comparative 
simulator  evaluation  of 
selected  concepts 

•  Finalize  design  guide- 
.  lines  for  standardized 
alerting  system 

•  Assess  certification 
impact 

•  Analyze  aircraft  accident 
and  incident  data 

•  Examine  the  cockpit 
environment 

•  Develop  expanded 
alerting  system  design 
concepts 

•  Identify  functional 
components  for  a  FPSM 

Period 

January  1979  to 
November  1979 

November  1 979  to 
February  1 980 

February  1980  to 
November  1980 

July  1 98^  to 

June  19S.2 

The  Phase  IV  study  showed  the  feasibility  of  the  concept  of  expanding  the 
functions  of  the  alerting  system  to  perform  as  a  flight  status  monitor.  A 
function  of  the  FSM  is  to  monitor  and  alert  the  crew  to  abnormal  flight 
operations  as  well  as  abnormal  system  operation.  Functional  requirements 
for  the  FSM  were  developed  on  the  assumption  that,  by  providing  the  crew 
with  guidance  and  feedback  In  their  response  to  abnormal  situations,,  their 
performance  could  be  Improved. 


Phase  IV  resulted  In  the  Identification  of  the  component  functions  that 
might  be  used  to  expand  an  alerting  system  into  a  flight  status  monitor. 
Specifically,  the  following  additional  capabilities  are  necessary  for  an 
alerting  system  to  function  as  an  FSM: 

o  Expanded  Sensing  -  To  provide  additional  sources  of  status  data 
(e.g.,  low  acceleration,  wind  shear,  tire/wheel  failure, 
navigation). 

o  More  Complex  Information  Processing  -  To  provide  additional  compu¬ 
tational  an  :!  data  handling  capabilities  to  consider  such  features 
as  flight  phase  adaptation,  predictive  and  multiple  alerts,  and 
Integrated  checklists. 

o  System  Interfacing  -  To  carry  out  data  exchange  between  the  FSM  and 
otnp^  data  handling  systems  such  as  flight  management,  performance 
management,  flight  control,  sensor  subsystems,  navigation,  communl- 
cations*  and  maintenance  data  recordings. 

o  Displaying  -  To  provide  the  crew  with  detailed  guidance  information 
to  facilitate  the  response  to  alerts  and  feedback  after  the 
response  has  taken  place. 

o  Controlling  -  To  provide  crews  with  the  capability  to  Interact  with 
the  psm. 

1.2  PRESENT  STUDY 


The  objective  of  the  present  study  Is  to  develop  and  evaluate  alternate  FSM 
concepts  for  providing  crew  guidance  and  feedback  to  facilitate  crew  and 
system  effectiveness.  This  effort  will  be  accomplished  In  two  phases. 

The  major  Phase  I  activities  have  Included: 


1.  Reviewing  the  results  of  Phase  IV  of  the  Aircraft  Alerting  System 
Standardization  Study  and  other  relevant  data  sources  to  identify 
the  requirements  for  expanding  the  alerting  system  into  an  FSM. 

2.  Deve1oping  preliminary  FSM  candidate  concepts  and  identifying 
design  Issues  relating  to  concept  implementation. 

3.  Performing  a  literature  review  to  obtain  data  for  answering  the 
design  questions  generated  by  the  team. 

4.  Developing  realistic  demonstration  scenarios,  based  upon  previous 
accidents/incidents,  to  provide  a  mechanism  for  evaluating  the 
candidate  concepts. 

5.  Implementing  the  FSM  concepts  and  demonstration  scenarios  In  a 
flight  deck  simulator  for  concept  demonstration/evaluation. 

6.  Conducting  demonstrations  and  developing  a  questionnaire  to  soil- 
clt  pilot  comments/opinlons  for  refining  the  candidate  concepts 
and  to  provide  data  for  resolving  FSM  implementation  Issues. 

In  Phase  II,  a  simulator  suite  will  be  developed  to  evaluate  the  utility  of 
the  refined  concept(s).  Line  qualified  pilots  will  "fly"  a  simulator  In 
aredeflned  scenarios  and  be  exposed  to  a  number  of  different  abnormal  and 
emergency  conditions. 

1.3  REPORT  ORGANIZATION 

Section  2  of  this  report  describes  the  procedure  used  to  develop  and  refine 
the  preliminary  FSM  concepts.  Scenarios  developed  to  demonstrate  FSM 
concepts  are  presented  in  Section  3.  Section  4  describes  the  objectives, 
procedures,  facilities,  and  results  of  the  FSM  demonstrations.  Section  5 
summarizes  the  Phase  I  accomplishments  and  provides  recommendations  for 
future  FSM  activities.  Appendix  A  contains  details  of  the  literature 
review  studies,  while  Appendix  8  chows  the  questionnaire  which  will  be  used 
tc  collect  pilot  opinion  data. 


2.0  CONCEPT  DEVELOPMENT 


2.1  PHASE  IV  CONCEPT  OF  THE  FSM 

The  Phase  IV  study  suggested  that  the  alerting  system  should  monitor  flight 
status  for  abnormal  operations  as  well  as  mechanical  failures  and  that  the 
system  should  guide  the  crew  through  the  appropriate  procedures  for  the 
situation.  This  finding  supported  an  early  program  assumption  that  the 
basic  functions  of  a  crew  alerting  system  should  Include: 

Alert  (Attention-Getting). 

Inform  (Identify  the  Problem). 

Guide  Crew  Action. 

Provide  Feedback. 


The  revolts  also  Indicated  that  It  would  be  feasible  to  expand  the  alerting 
system,  as  described  In  the  guidelines  (Berson,  Po-Chedley,  Boucek,  Hanson, 
Leffler  and  Hasson,  1981),  to  provide  an  FSM  capability.  Phase  IV  objec¬ 
tives  for  the  FSM  Included  requirements  for: 

o  Flight  Phase  Adaptation  -  The  Phase  IV  accident  survey  shewed  that 
60  percent  of  the  accidents  occurred  during  takeoff,  final  ap¬ 
proach,  and  landing.  These  critical  flight  phases  are  character¬ 
ized  by  Increased  crew  activity  and  coordination.  The  flight  crew 
should  be  protected  from  distractions  from  the  piloting  tasks  dur¬ 
ing  these  flight  phases.  Flight  phase  must  be  taken  Into  account 
when  determining  alerting^ requirements.  Alert  prioritization  and 
Inhibition  schemes  should  be  considered  In  FSM  design. 

o  Multiple  Alert  Capability  -  The  survey  showed  that  In  73  percent 
of  the  accldents/lncl dents  reviewed  there  were  multiple  causal 
factors.  It  Is  unknown  how  many  of  the  multiple  factors  occurred 
simultaneously;  the  accident  histories  report  very  few  occasions 
where  alerting  devices  were  aci'vated.  However,  It  Is  assumed 
that  there  can  be  failures  precipitated  by  multiple  and  unrelated 
failures  over  a  short  period  of  time.  When  these  alerts  are 
presented  to  the  crew  In  the  form  of  multiple  and  simultaneous 
alarms,  crew  workload  can  significantly  Increase.  The  system 
should  be  able  to  quickly  and  reliably  determine  the  relative 
criticality  of  the  alerts  and  display  them  to  the  crew  for  their 
response. 

o  Guidance  and  Feedback  -  The  FSM  should  be  capable  of  facilitating 
tne  completion  of  the  appropriate  procedural  steps  in  response  to 
alerts.  The  accldert  survey  showed  that: 
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o  19  percent  of  all  accidents  were  caused  primarily  by  crew 
error  involving  failure  to  follow  approved  procedures 

o  11  percent  of  all  accidents  caused  primarily  by  crew  error 
Involved  pilots  taking  the  wrong  action  or  taking  no  action 
when  one  was  required 

o  6  percent  involved  misunderstood  Instructions 
2.2  REFINEMENT  OF  PHASE  IV  CONCEPTS 


In  developing  the  alternative  FSM  design  requirements,  current  commercial 
transport  aircraft  procedures  such  as  described  in  the  TWA  Flight  Handbook 
for  the  767  were  reviewed.  In  general,  current  alert  resolution  procedures 
consist  of  cancelling  the  master  warning/  caution  indicator,  performing  the 
memory  items  (i.e.,  those  actions  requiring  immediate  attention  for  a 
warning  alert),  searching  for  and  reading  the  abnormal  procedure  on  the 
checklist  cards,  performing  the  procedure,  and,  when  time  is  available, 
checking  the  flight  manual  for  secondary  procedures  and  Information  rela¬ 
tive  to  the  emergency.  Each  procedure  In  the  checklist  and  flight  manual 
Is  prefaced  by  the  failure.  The  first  part  of  the  procedure  lists  the 
actions  necessary  to  contain  or  correct  the  abnormal  situation.  The  second 
part  reviews  flight  plan  Information,  and.  If  required,  special  tasks  for 
configuring  the  aircraft  for  landing. 

Based  on  the  review  and  Phase  IV  results,  the  study  team  concluded  that  the 
following  information  could  aid  the  crew  In  responding  to  alerts: 

°  Procedures  -  Sten-by-step  listings  of,  the  actions  required  to 
resolve  the  alerting  situation.  These  are  currently  provided  by  a 
combination  of  crew  memory  Items  and  procedures  contained  on 
checklist  cards  and  amplification  In  flight  manuals. 

o  System  Configuration  -  Representation  of  the  operation  and  func- 
tion  or  aircraft  subsystems  (e.g.,  hydraulic,  electric).  Present¬ 
ly*  this  information  Is  currently  either  remembered  by  the  pilot 
or  described  In  the  operations  manual. 

o  Falled-System  Status  -Representation  of  the  Impact  n*  faulted 
subsystems  with  indications  of  the  failed  components.  7  is  In¬ 
formation  Is  presently  contained  on  the  systems  panels. 

6  . 


0 


Aircraft  Status  -  Representation  of  the  impact  of  faulted  systems 
on  the  operational  limits  and  aircraft  flying  qualities.  This 
information  is  either  described  in  the  operations  manual ,  flight 
manual ,  or  remembered  by  the  crew.  , 

o  Info-mation  -  Information  pertaining  to  the  alerting  situation 
which  is  relevant  to  the  remainder  of  the  flight  (e.g,,  plan  for  a 
20°  flap  landing).  This  information  is  currently  contained  in  the 
checklist  cards  and  the  flignt  manual. 

The  study  team  proposed  that  the  above  information  could  be  presented  on 
two  multi -function  color  displays: 

1.  A  procedures  display,  providing  step-by-step  action  items  for 
resolving  alerting  situations. 

2.  A  status  display  providing  aircraft  status  (including  the  impact 
of  faults  on  aircraft  operating  conditions,  limits,  and  flying 
qualities),  system  status,  and  pertinent  information. 

It  was  assumed  that  these  two  displays  should  have  both  graphic  and  alpha¬ 
numeric  capabilities,  and  that  they  could  accomplish  all  of  the  FSM  func¬ 
tional  design  requirements  Identified  previously. 

2.2.1  FSM  Design  Issues 

During  concept  development,  various  design  issues  were  Identified  which 
require  additional  research  and  evaluation.  These  issues  Include  proce¬ 
dures  and  status  display  content,  format,  method  of  Information  coding,  and 
symbology  design.  Other  Issues  involve  crew  Interactions  with  the  FSM  dis¬ 
plays,  mechanisms  for  performing  procedural  action  Items,  and  mechanisms  , 
for  Implementing  alert  prioritization,  inhibition,  and  flight  phase  adapta¬ 
tion  schemes. 

2. 2. 1.1  Procedures  Display  Design  Issues 

Conceptual  formats  for  the  procedures  display  Include  word  checklists,  word 
descriptions,  and  task  flow  diagrams.  The  symbol  or  character  design 
Issues,  l.e.,  resolution,  brightness  contrast,  character  size,  and  font 
etc.,  are  covered  by  basic  human  engineering  practices  in  the  design  of 
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electronic  displays.  The  procedures  display  developed,  assumes  a  capabi¬ 
lity  to:  (1)  provide  step-by-step  procedural  information  for  resolving 
alerting  situations,  (2)  integrate  procedures  for  handling  multiple 
failures,  and  (3)  provide  feedback  as  to  the  adequacy  of  the  crew's 
response.  The  primary  design  issues  in  implementing  these  capabilities 
include: 

1.  Information  Content  -  Should  memory  items,  abnormal  procedures, 
adv i sory  i ntormati on ,  or  normal  checklists  be  presented? 

2.  Presentation  Format  -  Should  alphanumeric  listings,  task  flow 
diagrams,  voice  messages,  or  combinations  of  the  above  be  pre¬ 
sented? 

3.  Coding  Dimensions  -  What  dimensions  should  be  used  for  coding 
information:  taTbr,  size,  shape,  brightness,  etc.? 

4.  Number  of  Action  Items  to  Display  -  How  many  action  Items  should 
appear  on  one  page:  one  (present  action),  three  (past,  present 
and  next  actions),  or  a  full  page  of  items? 

5.  Syntax  -  What  type  of  syntax  should  be  used  to  present  procedural 
information? 

6.  Duplication  of  Procedures  -  Should  the  procedures  look  the  same  as 
the  procedures  In  the  flight  operations  manual? 

7.  Abbreviations  -  When  and  how  should  abbreviations  be  used? 

8.  Branching  Statements  -  How  should  branching  be  handled  for  both 
Interactive  and  non -interactive  procedures? 

9.  Mul tiple  Alerts  -  How  should  multiple  alerts  be  handled,  if  alerts 
are  of  the  same  or  different  alert  levels? 

10.  Noncompl eted  Acti ons  -  Should  the  crew  be  allowed  to  skip  steps 
and  how  should  the  noncompleted  steps  be  indicated? 

11.  Procedures  Compl eti on  -  What  should  happen  to  the  procedures 
display  after  the  alert  resolution  procedures  have  been  completed? 


2. 2. 1.2  Status  Display  Design  Issues 


As  discussed  previously,  status  Information  may  aid  the  crew  in  correcting 
a  fault  and  assist  them  In  identifying  changes  In  the  aircraft's  operation¬ 
al  limits.  The  following  types  of  status  Information  could  be  presented: 

1.  A  display  of  the  failed  system  to  identify  the  fault. 

2.  A  display  of  the  system  wherein  the  procedural  steps  are  being 
performed  to  obtain  feedback  on  crew  and  system,  actions. 

3.  Aircraft  status  to  indicate  changes  in  operational  limits  and 
flight  status. 

Various  format  concepts  for  the  status  displays  have  been  suggested,  in¬ 
cluding  alphanumeric  lists,  pictorial  system  schematics,  and  voice  mes¬ 
sages.  As  In  the  design  of  the  procedures  display,  basic  human  engineering 
design  principles  need  to  be  applied,  with  special  attention  to  the  simpli¬ 
fication  of  pictorial  Information  and  the  use  of  the  coding  dimensions. 
Status  display  design  Issues  Include. 

1.  Information  Content  -  Is  aircraft  status  Information  required  for 
the  crew  to  resolve  alerting  situations?  What  type  of  Information 
should  be  provided:  failed  systems,  operational  limits,  or  other 
Information?  Kow  much  information  should  be  presented:  the 
faulted  portion  of  the  system  or  the  entire  system?  Should  quan¬ 
titative  Information  be  presented  and  if  so,  by  numerics, 
graphics,  or  both? 

2.  Type  of  Format  -  Should  status  Information  be  presented  pictorial  - 
ly  such  as  by  schematics,  alphanumeric  lists,  voice  messages,  or 
any  combination  of  the  three? 

3.  Information  Coding  -  What  display  dimensions  should  be  used  for 
Information  coding,  such  as  color,  shape,  brightness,  and  shading? 

4.  When  to  Present  Status  01 splay  -  Should  status  Information  be 
presented  during  alert  resolution,  after  alert  resolution,  or  at 
any  time  desired  by  the  crew? 


5.  System  Panel  Similarity  -  If  system  overhead  panels  are  used  and 
subsystem  status  information  is  presented  on  the  status  display, 
how  closely  should  the  status  Information  resemble  the  information 
on  the  overhead  panel? 

6.  Level  of  Detail  -  How  much  detail  should  be  provided?  Should  data 
be  presented  from  a  detailed  level  to  a  general  level,  or  vice 
versa? 


2.2. 1.3  Crew  Interaction  Issues 


The  main  crew  Interaction  Issue  Involves  the  amount  of  automation  provided 
by  the  FSM.  The  following  levels  of  automation  were  Identified: 

1.  Manual  -  Crew  Is  required  to  manipulate  the  FSM  displays  and  to 
perfonn  the  corrective  actions  manually. 

2.  System  Aided  -  Some  FSM  system  operation  Is  automated.  Crew 
interaction  with  the  aircraft  systems  Is  through  the  FSM  system. 
The  crew  Interacts  with  the  system  by  the  use  of  multifunction 
Interactive  devices,  such  as  multifunction  keyboards,  touch  panels 
or  voice  actuation. 

3.  Automatic  -  Crew  Interaction  Is  minimal.  Crew  Is  only  required  to 
initiate  system  reconfiguration,  and  the  FSM  performs  the  control 
actions. 


There  are  two  categories  of  crew  Interaction  associated  with  the  FSM:  (1) 
control  of  the  FSM  displays,  and  (2)  control  of  the  aircraft  systems  as¬ 
sociated  with  the  FSM  procedures.  The  following  design  Issues  were  devel¬ 
oped  with  regard  to  these  types  of  Interactions: 

1.  Method  of  Display  Control  -  Should  the  FSM  displays  be  called  up 
manually  or  automatically?  Should  call  up  depend  upon  the  alert 
level  or  the  type  of  Information,  l.e.,  procedures  or  status? 

2.  Type  of  FSM  Display  Control  -  Should  line  select  keys,  a  raultlr 
runctl on  keyboard,  a  touch  panel ,  or  a  dedicated  keyboard  be  used 
to  control  the  FSM  displays?  Should  voice  control  be  a  primary 
mode  of  control  or  only  be  used  as  a  backup? 

3.  Method  of  Aircraft  System  Control  -  Should  pilot-aircraft  system 
interaction  be  performed  manually  via  dedicated  system  panels 
(l.e.,  the  overhead  panel),  system-aided  where  the  Interface  Is 


through  the  FSM  system,  or  automatic?  If  automatic,  should  the 
crew  be  capable  of  stopping  a  procedure  or  reconfiguring  the 
system  after  the  automatic  reconfiguration  occurs? 

4.  Type  of  Aircraft  System  Control  -  What  device  should  be  used  for 
FSM  crew  interaction;  a  multifunction  keyboard,  a  touch  panel  or 
voice  actuation?  Should  a  multifunction  keyboard  be  arranged  by 
the  sequence  of  events  or  by  the  structure  of  the  subsystem?  With 
a  touch  panel,  should  control  be  via  a  softkey  {software  control¬ 
led  function)  adjacent  to  the  procedure,  a  softkey  next  to  the 
component  on  the  system  schematic,  or  by  a  component  symbol 
itself? 


2.2.2 


As  previously  mentioned,  the  preliminary  FSM  concepts  proposed  two  multi¬ 
function  displays,  one  to  show  procedural  action  Items  and  one  to  provide 
status  reports.  Crew  Interaction  devices  Include  line  address  keys,  touch 
panels,  dedicated  keyboards,  and  voice  Input  systems  emerging  as  potential 
FSM  candidates.  In  addition,  numerous  questions  were  Identified  relating 
to  the  design  and  Implementation  of  these  displays  and  interactive  devices. 
Therefore,  a  review  of  the  published  literature  was  conducted  obtain 
data  for  resolving  these  design  questions.  Comparisons  of  dltferent 
display  and  control  formats  were  sought.  Although  many  descriptions  of 
"checklist"-  and  "schematic  diagram"-  type  displays  were  found,  no  compari¬ 
son  studies  or  "hard"  empirical  data  could  be  located.  The  studies  de¬ 
scribed  then  do  not  present  statistical  results  to  support  or  refute  the 
use  of  any  specific  mechanism;  Instead,  they  present  display  and  control 
formats  as  designed  by  professionals  according  to  unique  sets  of  require¬ 
ments.  Among  systems  currently  reported  In  the  literature,  no  standardiza¬ 
tion  exists. 


With  the  exception  of  one  source,  all  articles  described  checklist  and 
schematic  presentation  formats  as  part  of  an  Integrated  system.  An  Inte¬ 
grated  system  is  one  where  displays  and  controls  are  designed  simultan¬ 
eously  and  are  Incorporated  Into  a  complete.  Interactive  system.  Thus,  one 


would  not  discuss  a  portion  of  an  Integrated  system  as  an  Independent  unit, 
but  would  Instead  refer  to  all  units  as  a  total  system. 

Therefore,  the  literature  found  on  Integrated  systems  will  be  described  . 
first,  followed  by  a  review  of  articles  which  discuss  schematic  diagrams, 
then  Information  pertaining  to  touch  panels  and  voice  input/output  systems 
will  be  given.  Appendix  A  contains  details  of  system  designs,  when  such 
details  were  provided  by  the  authors. 

2.2.2. 1  Integrated  Systems 

In  a  discussion  of  flight  displays  for  the  next  generation  aircraft,  Dunn 
(1976)  suggested  using  checklists  with  logic  routines,  where  sensed  fail¬ 
ures  could  lead  to  the  automatic  display  of  appropriate  checklist  proce¬ 
dures.  He  also  suggested  that  automated  checklists  could  Improve  crew 
efficiency  and  performance  effectiveness.  However,  Dunn  emphasized  that 
research  should  be  conducted  to  determine  the  best  method  of  Implementa¬ 
tion. 

Wasson  and  Archer  (1981)  examined  how  advances  in  technology  (such  as  touch 
panels  and  voice  Input)  could  affect  Lockheed's  1990's  flight  station.  The 
authors  recommended  an  Integrated  display  and  control  system  for  future 
aircraft,  where  one  display  Is  capable  of  showing  schematic  system  diagrams 
and  presenting  checklists  with  operator  Interaction  via  a  touch  panel. 

They  mentioned  voice  Input  as  another  crew  Interface  modality.  Applying 
voice  Input  would  free  the  eyes  and  hands  for  other  tasks,  but  voice  Input 
should  not  be  used  for  all  control  tasks.  Safeguards  should  be  employed  to 
prevent  accidental  activation  through  normal  cockpit  conversation.  Poten¬ 
tial  applications  of  voice  systems  Include  accessing  information  (i.e., 
checklists)  and  entering  data. 

Gartner  and  Holzhausen  (1979)  described  a  Touch  Input  Control  Device  to  be 
used  as  part  of  an  Integrated  cockpit  display  and  control  system.  The 
authors  suggested  that  displays  and  controls  for  several  airborne  systems 
could  be  combined  Into  one  space  and  located  In  the  pilot's  primary  field 
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of  view.  They  a’ so  recommended  a  multifunction  display  for  future  air¬ 
craft,  where  several  types  of  information  could  be  presented  {such  as 
checklist;  anci  system  schematics).  Touch  panels  would  be  used  to  control 
the  display  ot  these  items.  The  authors  presented  an  example  of  an  Inte¬ 
grated  Flighc  Management  System  containing  several  components,  including 
computer  controlled  checklist  procedures.  To  access  the  checklist  and 
perform  the  necessary  procedure,  the  operator  chooses  desired  functions  via 
a  series  of  functional  task  selection  keypads  presented  on  the  screen  in 
sequential  (hierarchical)  order.  Details  of  this  process  are  presented  in 
Appendix  A. 

Streeter,  Weber,  and  Oplttek  (1973)  conducted  the  "Master  Monitor  Display 
Study".  An  integrated  display  system  was  devised  which  contained  warning 
and  caution  information,  mode  advisory  data,  functional  failure  Informa¬ 
tion,  and  auxiliary  data  all  presented  on  the  same  display  surface.  In 
addition  to  the  general  categories  mentioned  above,  checklist  procedures 
from  the  F-14A  aircraft  were  presented.  One  display  format  was  selected 
which  could  accommodate  both  quantitative  and  qualitative  data.  Six  data 
levels  were  presented  ranging  from  system  status  data  to  fault-correction 
procedures  (checklists).  The  progression  through  data  levels  (as  described 
In  Appendix  A)  was  accomplished  either  manually  vr  automatically.  Sche¬ 
matic  diagrams  were  presented  at  the  SUBSYSTEM  level,  Indicating  both 
normal  and  faulted  conditions.  Checklist  procedures  were  presented  at  the 
PROCEDURAL  level  (the  most  detailed  of  the  six  levels).  Figure  2.2.2. l-l 
shows  a  checklist  procedure. 

The  authors  did  not  see  any  functional  utility  of  schematic  presentations, 
so  this  mode  was  not  discussed  in  much  detail.  It  was  stated  that  such  a 
presentation  may  help  highly  skilled  pilots  explore  alternative  methods  to 
correct  a  malfunction.  Schematic  diagrams  were  demonstrated  only  to  show 
the  display  system's  capability. 


OUTBOARD  SPOILERS 


FLUID  LEVEL  O 

PRESSURE  O 

PROCEDURE 

1 .  LAND  ASAP 

2.  OUTBOARD  SPOILER  OFF 
USE  GND  CK  PANEL.SW 

1  l 

INOP  EQUIP: 

OUTBOARD  SPOILERS 
FLAP/SLAT  BACK-UP 
DLC/ACL 

OTHER  SYSTEMS  -  NORMAL 


Figure  2.22. 1  *  1  Sample  Checklist  Procedure  (Streeter,  Weber,  and  Opittek,  1973} 
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Perhaps  the  most  comprehensive  design  of  checklist  and  schematic  presenta¬ 
tion  formats  was  undertaken  by  Sexton  (1983),  In  an  effort  to  describe  a 
conceptual  design  for  a  1990 's  transport  aircraft.  Several  topics  were 
discussed  by  Sexton,  Including  symbology  and  symbol  logic  of  schematic 
diagrams.  The  major  coding  requirement  for  symbology  was  the  need  for 
consistency,  especially  with  related  formats  such  as  functional  systems 
formats.  Figure  2.2.2. 1-2  demonstrates  some  examples  of  the  symbology  used 
on  functional  systems  formats.  Symbology,  symbol  logic  and  color  coding 
Interact  In  several  cases. 

Several  requirements  were  also  listed  for  voice  command  and  response. 
Basically,  Sexton  noted  that  voice  Input  could  be  used  to  call  up  Informa¬ 
tion  such  as  checklist  procedures;  voice  output  (or  synthesis)  could  be 
used  to  automatically  convey  time-critical  messages,  or  to  read  warning, 
caution,  and  advisory  messages  on  demand.  Checklist  Item  completion  could 
require  use  of  voice  Input  and  checklist  readout  could  require  voice  out¬ 
put. 


Touch  panel  technology  may  be  used  for  checklist  Item  completion  and  switch 
function  control  on  system  schematics.  Touch  switches  were  also  used  for 
PAGE,  STORE  and  RECALL  functions  for  caution  and  advisory  level  alerts. 

'  l 

Checklist  operation  for  both  normal  and  abnormal  procedures  Is  presented  In 
Appendix  A.  • 

The  only  operational  aircraft  that  piW4des  checklists  on  electronic  dis¬ 
plays  Is  the  A310,  which  has  the  Electronic  Centralized  Aircraft  Monitor 
(ECAM).  The  ECAM  provides  the  crew  with  checklist  and  status  Information 
for  both  normal  and  abnormal  flight  situations.  The  Information  Is  pre¬ 
sented  on  two  centrally  located  CRT  displays,  by  means  of  alp  rnierlc 
messages  and  system  synoptics  (generalized  sciematlcs  of  aircraft  systems). 
A  control  panel  is  provided  for  clearing  the  display,  calling  up  status 
Information,  recalling  a  procedure,  and  selecting  system  synoptics.  A 
conventional  annunciator  panel  Is  used.  Aircraft  system  controls  are 
located  on  the  overhead  panel.  Thus,  the  ECAM  Is  a  display  system  which 
uses  CRTs  for  the  presentation  of  procedural  Messages  and  status 


Figure  2.2.2. 1-2  Example  Functional  System  Symbology  (Sexton.  1983} 
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information,  in  addition  to  the  conventional  annunciation  and  control 
devices.  Appendix  A  contains  a  description  of  ECAM  operation. 

In  an  unpublished  report,  Boeing  documented  empirical  and  subjective  data  from 
an  evaluation  of  an  Advanced  Systems  Monitor  (ASM)  conducted  in  1975.  The  ASM 
was  proposed  to  be  a  versatile  method  of  acquiring,  managing,  and  displaying 
information  concerning  the  status  of  aircraft  operating  systems.  For  the 
test,  the  conventional  dial  type  engine  and  propulsion  instruments  were 
removed  from  the  center  instrument  panel  of  a  737  simulator  and  replaced  with 
two  side-by-side  CRTs  which  displayed  the  required  systems  data.  A  control- 
display  unit  was  used  to  (1)  display  the  status  of  the  various  aircraft 
systems,  (2)  manually  select  the  system  format  or  checklist  to  be  displayed  on 
the  CRT,  (3)  insert  flight  data  information  for  computation  and  display, 

(4)  perform  Item-by-item  checklist  accomplishment  and,  (5)  remove  unneeded 
displays  from  the  CRT.  Each  CRT  was  divided  Into  upper  and  lower  display 
sections.  For  normal  operations  the  captain's  CRT  upper-half  showed  engine 
data;  the  first  officer's  upper-half  showed  systems  information.  The 
lower-half  of  each  CRT  could  be  used  to  manually  display  system  formats  or 
checklists  at  the  crew's  discretion  or  for  automatic  emergency  checklist 
display.  The  report  concluded  that,  overall,  the  ASM  Improved  cockpit 
operations.  The  Improvements  were  primarily  associated  with  checklist 
utilizations.  Since  the  improvements  were  small  and  primarily  attributable  to 
this  one  feature  of  the  ASM,  it  remained  questionable  whether  a  "full  blown" 
ASM  was  justifiable  in  new  aircraft  or  whether  just  certain  elements,  such  as 
semi -automated  checklists,  should  be  Implemented. 

Gallon  and  Currin,  1984  developed  a  Multifunction  Display  (MFD)  System  for 
future  commercial  transport  aircraft.  The  MFD  presents  engine  parameters, 
alert  lists,  abnormal  procedures,  aircraft  limitations,  system  schematics 
associated  with  the  procedures,  and  normal  flight  phase  Information. 

Alternative  designs  for  a  CRT  display  system  were  evaluated.  The  recom¬ 
mended  configuration  uses  two  8"  x  8"  CRTs  arranged  side  by  side  (see 
Figure  2. 2. 2. 1-3).  These  displays  are  driven  by  the  flight  warning 


17 


Figure  2. 2.2. 1  -3  MFD  Primary  Procedure  and  Status  Display  (Gallon  and  Currin,  1 984) 
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computer  and  have  an  associated  control  panel.  System  control  and  limited 
system  status  Information  Is  provided  by  the  overhead  panel.  A  warning 
annunciator  panel  Is  provided  In  case  of  MFD  failure.  During  normal  opera¬ 
tion,  the  left  CRT  displays  the  primary  engine  parameters  In  analog  form 
and  the  secondary  parameters  digitally.  The  right  display  provides  a 
dedicated  area  for  alerts,  a  listing  of  temporarily  used  memo  functions, 
and  flight  phase  Information.  There  are  five  flight  phase  formats,  which 
contain  a  mixture  of  alphanumerlcs  and  pictorial  information. 

An  example  of  the  cruise  flight  phase  Is  shown  In  Figure  2. 2.2. 1-4.  A 
description  of  MFD  operation  Is  provided  In  Appendix  A. 

2. 2. 2. 2  Schematic  Diagrams 

Summers  and  Erickson  (1982)  developed  design  principles  and  guidelines  for 
a  multi format  electronic  display  system  which  would  be  used  to  monitor  and 
manage  aircraft  systems.  The  Intent  was  to  Identify  crew  actions  and 
Information  requirements  via  a  systems  engineering  approach.  A  model  of 
the  crew  functions  for  normal  and  abnormal  operations  of  the  aircraft 
systems  was  developed.  Task  flow  diagrams  of  the  crew  functions  were 
derived  using  the  model.  From  these  task  flow  diagrams,  the  Information 
requirements  to  perform  the  functions  were  Identified.  The  Information  was 
categorized  Into  the  following  classes: 

1)  Identifiers  -  The  Identity  and  the  location  of  a  component  or  a 
control . 

2)  Descriptors  -  The  description  of  a  component  or  a  system. 

3)  Status  -  The  present  status  of  a  component  or  a  system. 

4)  Instructions  -  The  actions  required  by  the  crew  to  manage  the 
sysT5t*7 

The  authors  suggested  two  formats  for  presenting  the  Information  to  the 
crew:  a  pictorial  format  (such  as  a  system  schematic),  or  by  written  text. 
The  pictorial  format  was  a  representation  of  a  system  schematic  with  a  list 

of  action  verbs  and  arrows  Indicating  the  site  of  the  actions.  The  written 
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text  format  11 -ted  the  Instructions  by  the  action  and  the  location  of  the 
action.  The  v tatus  of  the  component  was  listed  by  an  Identifier  and  the 
state  of  the  component.  In  both  formats  color  coding  was  used  to  Indicate 
fault  level:  red  for  warnings,  amber  for  cautions,  cyan  for  advisories, 
and  green  for  normal  conditions.  Three  alternatives  were  given  for  system 
control:  (1)  dedicated  system  control  panels,  (2)  a  multifunction  system 
control  panel,  and  (3)  a  touch  panel  that  would  overlay  the  system  informa¬ 
tion  display.  The  authors  proposed  an  empirical  evaluation  of  these  con¬ 
cepts  by  flight  simulation  with  both  normal  and  abnormal  flight  scenarios. 
To  date,  these  evaluations  have  not  been  completed. 


2.2. 2.3  Touch  Panel  Systems 

Gartner  an*1  Holzhauzen  (1979)  listed  the  following  ergonomic  problems  and 
areas  cf  Improvement  associated  with  the  use  of  touch  panels: 


o  Virtual  switch  size  o  Improved  operator  training 

and  feedback  necessary 

o  Distance  between  virtual 

switches  o  Unexpected  delays  In  system 

acknowledgement  may  lead  to 
o  Number  and  arrangement  of  frustration 

i  switches  for  various 

applications  o  Distance,  angle,  bright¬ 

ness,  and  contrast  must  be 
o  Switch  shape  alterable  under  different 

lighting  conditions 

o  Switch  color 

o  Problems  may  exist  with 
o  Type  of  feedback  Integrating  touch  panels 

Into  the  existing  system 

o  Menu-hierarchy  structuring 

o  More  work  Is  needed  on  the 
menu-hierarchy  progression 
of  prompting  sequences  on 
the  display. 


Pfauth  and  Priest  (1981)  presented  a  comprehensive  report  on  touch  panel 
technologies,  where  they  listed  the  following  advantages  and  disadvantages: 


Advantages 

o  Input/output  In  one 
location 

o  Fast  data  entry  and  control 
for  certain  tasks 

o  Minimal  amount  training 
requl red 

o  Only  valid  options 
available 

o  High  operator  acceptance 

o  Immedl ate  feedback 

o  Symbolic/graphical 
representation 

o  Minimal  operator  memori¬ 
zation  required 


D1 sadvantages 

o  Initial  cost 

o  Increased  programming  time 

o  Need  keyboard  for  some 
types  of  Input 

o  Parallax  problem  affecting 
touch  locations 

o  Glare 

o  Fatigue 

o  Flnger/arm  visually 
blocking  other  control  - 
display  areas 

o  New  method  required  for 
programming  Interface 
software 


o  Minimal  eye-hand  co¬ 
ordination 

Pfauth  and  Priest  also  mentioned  that  touch  screen  devices  are  generally 
>sed  for  gross  resolution  tasks.  The  technology, exists  to  Implement  these 
devices  for  fine  resolution  applications,  but  to  date.no  one  has  studied 
the  possibilities.  In  aircraft  applications,  vibration  Is  an  Important 
element  In  the  design  of  a  touch  panel  system.  Several  factors  were  deemed 
Important  by  Pfauth  and  Priest  In  the  acceptance  of  a  touch  system,  the 
most  pertinent  being  the  acceptance  of  such  a  system  In  high  stress 
environments.  Some  design  considerations  are  listed  In  Appendix  A. 


Colorgraphlcs  and  touch  panel  overlays  were  the  topic  of  a  paper  by 
Conquest  (1983)  with  regard  to  Automatic  Test  Equipment  (ATE).  Conquest 
developed  a  model  to  assess  several  aspects  of  the  system  Including:  human 


factors  concepts,  system  components,  touch  panel  concepts,  and  applica¬ 
tions.  Personnel  of  various  skill  levels  used  the  model  to  provide  feed¬ 
back  on  the  usability  of  this  particular  type  of  interface.  Conquest  men¬ 
tioned  that  a  colorgraphic  display  could  be  understood  faster  than  a 
conventional  monochromatic/alphanumeric  display.  He  also  listed  two  advan¬ 
tages  to  using  a  touch  panel  overlay  with  such  a  display:  (11  operator 
error  rate  is  lowered  because  the  system  would  be  able  to  understand  inputs 
more  easily  (only  acceptable  inputs  would  be  available),  and  (2)  a  lower 
operator  skill  level  would  be  required  for  complex  tasks  (graphics  would  be 
easy  to  decipher). 

Under  “Human  Factors  Concepts,"  the  layout  of  display  items  was  discussed. 
Dedicated  areas  were  provided  for  commands,  graphics,  and  for  "softkeys", 
touch  control  keys  which  can  be  re-programmed  for  various  applications. 

The  only  softkeys  not  included  in  the  dedicated  control  area  were  those 
used  for  station  mode  changes. 

System  components  include  size  and  resolution  of  the  display,  and  overlay 
type.  To  meet  high  resolution  touch  panel  requirements.  Conquest  stated 
that  a  transparent  resistive  CRT  overlay  should  be  used.  Other  tech¬ 
nologies  (such  as  capacitive  and  infrared)  cannot  reach  the  resolution 
accuracy  provided  by  the  resistive  touch  panel.  However,  there  are  some 
disadvantages  to  using  a  resistive  t. -ch  panel.  Because  of  the  resistive 
substrate,  the  panel  blocks  a  pprtion  of  the  CRT  light  output.  Also,  the 
extra  surface  adds  to  the  reflection  of  incident  light,  therefore  special 
considerations  need  to  be  made  when  designing  a  system  for  use  in  widely 
varying  lighting  conditions  (such  as  aircraft  cockpits). 

The  "softkey"  concept  was  the  primary  touch  panel  concept  described.  The 
size  and  placement  of  the  keys  on  the  display  is  constant;  only  the  func¬ 
tionality  varies.  There  are  two  advantages  to  such  a  system:  (1)  the 
softkeys  remain  in  the  same  area  on  the  screen  (consistency  of  placement), 
and  (2)  softkeys  can  be  easily  programmed  for  various  applications.  Some 
critical  factors  exist  with  respect  to  the  design  of  a  softkey  concept. 

One  Is  the  alignment  of  the  panel  rejjjonses  with  the  display  area.  After  a 


functional  change  has  been  made  to  a  softkey.  It  Is  Imperative  that  only 
the  appropriate  key  locations  be  operational,  meaning  that  a  valid  key 
should  provide  the  desired  system  response,  and  an  Invalid  key  should  be 
Ignored.  Another  factor  to  consider  Is  size  of  the  keys,  as  well  as  spac¬ 
ing  between  keys.  Amount  of  space  consumed  by  each  key  must  be  weighed 
against  the  ease  of  hitting  a  displayed  kay.  The  parallax  problem  encoun¬ 
tered  with  some  types  of  touch  panels  Is  also  mentioned  as  a  factor.  Feed 
back  Is  another  Important  concept,  with  a  burst  of  audio  being  the  recom¬ 
mended  feedback  after  touching  a  valid  softkey. 

Several  applications  of  colorgraphlcs  and  touch  panels  are  discussed  by 
Conquest,  such  as: 

1.  The  operator  can  be  led  through  a  set  of  decision  points  graphi¬ 
cally  when  testing  a  faulted  unit. 

2.  The  Interface  can  display  graphically  what  to  adjust  or  look  for 
on  the  unit  under  test. 

3.  A  fault  can  be  Isolated  via  a  graphic  representation  or'  the  unit 
under  test. 

In  his  conclusion.  Conquest  summarizes  the  advantages  of  the  softkey  con¬ 
cept;  lower  error  rates,  lower  skill  level  required,  "natural"  data  Input 
by  use  of  the  finger,  elimination  of  confusing  keyboards,  and  versatility 
In  applications. 


2. 2. 2. 4 


In  a  1983  report,  Steiner,  Burkhart,  and  Berson  discussed  Automatic  Speech 
Technology  (AST),  a  combination  of  word  recognition  and  speech  synthesis. 
They  compiled  the  following  list  of  advantages  and  disadvantages: 


Advantages 


01 sadvantages 


o  Natural  form  of  communica¬ 
tion  -  requires  little 
training. 


o  Reliability  questionable 
wl th  envl ronmental  nol se 
and  vibration. 
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Advantages  (Cont.) 


Disadvantages  (Cont.) 


o  Faster  and  more  accurate 
than  keyboard  data  entry 
when  eyes  and  hands  are 
busy. 

o  Freedom  of  movement  given 
to  operator. 

o  Simultaneous  communication 
possible  with  machines  and 
other  humans. 

o  Serves  as  form  of  identi¬ 
fication. 

o  Increased  communication 
capability  may  be  useful  In 
time-critical  situations. 


o  Voice  input  error  detection 
and  correction  "not  fully 
defined”. 


o  Correcting  recognition 
errors  may  lead  to  other 
errors  which  in  turn  may  be 
frustrating. 

o  Necessity  to  pause  between 
utterances  can  cause 
frustration. 

o  Messages  could  interfere 
with  other  operations 
(i.e.,  radio). 

o  Inter-individual  and  intra- 
individual  differences 
could  affect  recognition 
system  operability. 

o  Limited  vocabulary  avail¬ 
able. 

o  Large  storage  facility 
necessary  for  large 
vocabulary. 

o  Keyboard  data  entry  faster 
for  simple  tasks. 

o  For  speech  synthesis: rate 
of  receiving  auditory 
messages  slower  than 
receiving  visual  messages. 


Steiner,  Burkhart,  and  Berson  concluded  that  systems!  which  require  complex 
and  simultaneous  tasks  could  benefit  from  AST*  thus,  voice  technology  would 
be  a  viable  mechanism  to  provide  guidance  and  feedback  during  an  emergency 
situation. 

Simpson  (1982)  found  that  speech  input/output  controls  can  reduce  heli¬ 
copter  pilots'  workload  during  missions  where  the  syes  and  hands  are  busy. 


Costet  (1982)  studied  single  seat  fighter  aircraft.  During  simulator 
tests,  a  synthesized  voice  using  a  vocabulary  of  approximately  60  words  was 
used  to  describe  manual  controls.  This  allowed  a  comparison  between  manual 
and  vocal  controls.  It  was  discovered  that:  (1)  voice  input/output  re¬ 
duced  pilot  workload  and  resulted  in  a  time  savings,  (2)  practice  with  the 
system  Improved  recognition  accuracy  to  95%,  and  (3)  an  ON/OFF  microphone 
switch  was  necessary  to  distinguish  the  voice  Input/output  commands  from 
ambient  noise. 

Steiner,  Burkhart,  and  Berson  compared  visual  vs.  voice  vs.  a  combination 
of  visual  and  voice  feedback  during  a  simulated  voice  activated  weapon 
launch  sequence.  To  Insure  that  subjects  attended  to  the  feedback,  incor¬ 
rect  feedback  was  presented  approximately  one- third  of  the  time,  and  sub¬ 
jects  were  instructed  to  say  "CANCEL"  at  such  a  time.  Visual  stimuli 
(prompts)  were  presented  on  a  terminal,  and  the  visual  feedback  (when 
presented)  appeared  next  to  the  prompts.  The  basic  results  of  their  study 
were: 

1.  Reaction  time  was  lower  with  a  combination  of  visual  and  vocal 
feedback,  as  opposed  to  either  visual  or  vocal  feedback  alone. 

2.  Number  of  errors  was  also  lessened  with  both  visual  and  vocal 
feedback. 

The  authors  concluded  that  both  auditory  and  visual  feedback  should  be 
provided  to  enable  the  operator  to  select  feedback  modality  based  upon 
present  operational  demands. 

In  conclusion,  It  appears  that  voice  Input/output  Is  an  appropriate  guid¬ 
ance  and  feedback  tool  In  complex  situations  (such  as  aircraft  emergen¬ 
cies).  Consideration  would  have  to  be  taken,  though.  In  the  Implementation 
of  the  system,  such  as  the  addition  of  a  voice  control  switch  to  lessen  the 
possibility  that  ambient  noise  would  interfere  with  message  transmission 
and  receipt. 


2. 2. 2. 5  Conclusion 


It  was  hoped  that  the  literature  review  would  provide  some  insight  on  the 
utility  of  various  concepts.  As  can  be  seen,  no  studies  were  published 
where  implementation  methods  had  been  compared,  and  no  standardization 
exists  among  system  designs.  Since  no  empirical  results  are  available,  the 
studies  discussed  above.  In  conjunction  with  the  results  from  the  demon¬ 
strations  and  results  of  the  questionnaire,  will  be  used  to  refine  the  FSM 
concepts  early  In  Phase  II. 

2.3  FSM  DISPLAY  AND  CONTROL  ELEMENTS 

Based  upon  the  workshop  sessions,  the  literature  review,  and  a  preliminary 
demonstration,  the  study  team  Identified  alternative  concepts  for  demon¬ 
stration.  Four  of  these  concepts  use  the  same  display  formats,  but  differ 
in  the  method  of  display  and  system  control.  A  fifth  concept  uses  a  dis¬ 
play  scratchpad  with  a  programmable  multifunction  keyboard,  and  another 
concept  Is  an  automatic  reconfiguration  of  the  system.  A  synopsis  of  the 
features  of  these  candidate  concepts  Is  presented  in  Table  2.3-1.  The  dis¬ 
play  and  control  elements  of  these  concepts  are  summarized  below. 

2.3.1  Alert  Display  and  FSM  Controls 

The  alert  display  Is  a  color  CRT  witr  line  address  keys  mounted  on  the  left 
and  right  sides.  The  FSM  controls  are  mounted  below  the  alert  display  as 
shown  in  Figure  2. 3. 1-1.  The  functions  of  the  alert  display  have  been 
described  In  Berson,  et  al,  1981.  It  displays  up  to  eleven  alerts  on  one 
page.  The  alerts  are  color  coded  and  prioritized  according  to  their 
urgency  level.  Mew  alerts  appear  at  the  top  of  the  list  in  their  alert 
category. 

With  each  alert  there  is  a  line  select  key.  This  allows  selection  of  a 
particular  alert  by  the  crew  which  activates  the  row  of  keys  at  the  bottom 
of  the  display.  These  keys  allow  the  crew  to  select  the  procedure  and 
status  pages  for  the  line-addressed  alert  by  depressing  the  checklist  and 
status  keys.  The  crew  can  step  through  the  procedure  and  status  pages  by 


Table  2.3- 1  Summary  of  Candidate  System  Concepts 
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Figure  2.3. 1~1  The  Alert  Display  with  F$M  Controls 


multiple  depressions  of  these  keys.  If  an  alert  has  been  addressed  and  the 
procedures  are  Incomplete,  the  store  and  recall  keys  are  Inhibited.  Once 
the  procedures  have  been  completed,  the  procedure  and  status  displays  are 
cleared,  and  If  the  alerting  situation  no  longer  exists,  the  alert  will  be 
removed  from  the  alert  display.  If  the  alert  was  In  a  lower  urgency  cate¬ 
gory  than  a  warning.  It  may  be  stored.  By  depressing  the  recall  key,  . 
stored  alerts  will  reappear  on  the  alert  display  and  the  crew  may  review 
the  procedures  and  status  by  depressing  the  line  select,  checklist,  and 
status  keys  in  sequence.  The  page  key  allows  the  crew  to  page  through  the 
alert  display  and  the  voice  key  activates  the  voice  system. 

2.3.2  Procedures  Display 

Step-by-step  procedures  for  responding  to  normal,  abnormal,  and  emergency 
situations  are  presented  on  the  procedures  display  In  checklist  format. 

One  action  Item  Is  presented  per  line  whenever  feasible,  and  as  many  action 
items  as  feasible  are  presented  on  a  single  page.  The  Items  requiring  crew 
action  are  one  color,  and  the  completed  actions  are  anotner  color.  As  the 
crtf  completes  an  action  the  actlc.  item  changes  format  and  color.  If  the 
action  Is  not  sensed  by  the  aircraft,  the  crew  must  acknowledge  Its  comple¬ 
tion,  by  selecting  a  "completed  action"  key,  before  the  Item  changes 
color/format.  Branching  Is  presented  by  "If  statements"  In  the  action 
color.  Once  the  action  Is  sensed  after  a  branching  statement,  the  one 
alternative  action  Is  presented.  If  the  crew  falls  to  perform  an  action 
Item  and  proceeds  to  the  next  action  Item,  the  uncompleted  Item  will  remain 
In  the  action  color. 


The  actions  will  be  listed  In  priority  order.  All  actions  that  have  an 
Immediate  effect  on  aircraft  safety  will  be  listed  first.  Cleanup  proce¬ 
dures  will  follow.  Procedures  affecting  other  flight  phases  will  follow 
the  cleanup  procedures.  (Such  procedures  will  automatically  be  Integrated 
Into  checklists  In  those  flight  phases.)  For  multiple  alerts,  the  actions! 
will  be  Integrated  according  to  the  priority  logic  established  by  the 
system.  Those  faults  that  cause  subsequent  faults  will  be  listed  first. 

If  these  are  corrected,  then  the  subsequent  faults  will  disappear.  In  case 
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of  Independent  failures,  they  will  be  listed  according  to  their  fault  level 
and  their  order  of  occurrence. 

2.3.3  Status  Display 

The  status  display  will  have  pictorial  and  alphanumeric  presentations. 

There  may  be  as  many  as  four  pages  associated  with  a  fault: 

1.  A  page  presenting  the  aircraft  status  showing  operational  limits 
and  the  non-operating  systems. 

2.  A  page  showing  the  schematic  diagram  of  the  system  involved  with 
the  procedural  action. 

3.  A  page  Identifying  the  system  with  the  primary  falTure. 

4.  A  page(s)  presenting  any  additional ,  operational  Information  that 
Is  currently  contained  in  operations  and  flight  manuals. 

The  first  status  page  will  show  aircraft  status.  Including  degraded  systems 
and  operating  limits.  The  second  page  will  display  a  diagram  of  the  proce¬ 
dural  action  site.  The  third  page  will  show  a  diagram  of  the  system  or 
subsystem  containing  the  failure  which  generated  the  alert.  The  fourth 
page  will  display  information  pertinent  to  flight  operations  as  a  result  of 
the  failure/  alerting  situation. 

System  statbs  will  be  shown  by  simplified  system  schematics.  These  sche¬ 
matics  will  show  system  flow  by  Interconnecting  lines  and  Identify  dif¬ 
ferent  components  by  symbol  shapes.  Color  coding  will  be  used  to  Indicate 
operating  and  fault  status.  For  example,  unfilled  symbols  could  Indicate 
"OFF”  status  and  a  filled  symbol  could  Indicate  "OH"  status.  Alphanumerics 
will  be  used  to  Identify  the  components  and  for  presenting  quantitative 
parameter  values  when  required. 

Aircraft  status  will  be  shown  by  a  simplified  pictorial  of  an  aircraft 
(e.g*,  a  plan  view  outline  of  the  aircraft).  Symbols  will  be  used  as  much 
as  possible  for  the  faulted  systems.  Other  Information  will  be  presented 
by  alphanumerics.  Failed  coponents  *111  be  color  coded  according  to  fault 
level  (e.g.,  red  or  amber). 
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2.3.4  System  Control 


Several  alternatives  have  been  selected  for  control  of  the  aircraft  systems 
in  conjunction  with  the  FSM.  These  include: 

1.  System  Control  Panels  -  System  control  panels  are  located  either 
at  a  flight  engineers  station  or  in  the  overhead  panel.  The 
aircraft  systems  are  controlled  with  the  systems  panel  which  is 
not  part  of  the  FSM.  However,  information  feedback  on  the  status 
of  the  controls  and  the  operation  of  the  system  is  provided  by  the 
FSM, 

2.  Touch  Panel  Control  -  The  touch  panel  overlaying  the  status  dis- 
play  allows  system  control  to  be  next  to  the  displayed  procedures. 
The  touch  panel  allows  the  crew  to  perform  the  action  item  by 
touching  the  display.  Feedback  information  is  presented  on  both 
the  procedures  and  status  displays,  and  the  crew's  attention  is 
focused  on  only  these  two  displays  for  completing  the  procedure. 

3.  Voice  Interactive  Control  -  Voice  commands  are  used  to  call  up  and 
control  the  displays  and  the  aircraft  systems.  The  voice  system 
is  activated  by  depressing  the  FSM  VOICE  key.  After  activation, 
the  crew  Is  able  to  call  up  and  perform  the  action  1  terns * 

4.  Multifunction  Keyboard  -  The  multifunction  keyboard  is  configured 
with  programmable  legend  keys.  The  first  key  lists  the  first 
action  Item  from  the  procedures  display.  The  second  action  item 
Is  listed  on  the  second  multifunction  key,  and  so  on.  To  perform 
the  action  item  all  the  pilot  has  to  do  Is  depress  the  correspond¬ 
ing  multifunction  key. 

2.4  CANDIDATE  CONCEPTS 


The  FSM  concepts  differ  in  their  level  of  automation:  manual,,  system  aided 
and  automatic.  With  the  manual  method,  aircraft  system  reconfiguration  is 
accomplished  on  the  systems  overhead  panel.  The  system  aided  concepts 
include  automatic  display  callup,  and  the  aircraft  systems  are  controlled 
by  Innovative  concepts  In  conjunction  with  the  FSM  displays  Including  voice 
interaction,  touch  panel  overlays,  and  a  multifunction  keyboard.  The  last 
concept  Is  automatic  reconfiguration  which  only  requires  the  crew  to  give  a 
go-ahead  signal.  This  concept  may  be  used  In  conjunction  with  any  of  the 


above  concepts,  but  for  this  study  it  was  implemented  only  In  the  multi-  • 
function  keyboard  concept.  In  all  of  the  concepts,  feedback  Information  is 
provided  on  both  the  procedures  and  status  displays. 


2.4.1  Basic  Concept 


The  operation  of  the  Basic  concept  is  shown  in  Figure  2. 4. 1-1.  After  an 
alert  occurs,  the  crew  cancels  the  master  caution  and  warning  Indicator  and 
reads  the  alert  display  to  Identify  the  fault.  By  pushing  the  line  select 
and  CHECKLIST  keys,  the  alert  procedure  Is  displayed  on  the  procedures 
display.  If  the  crew  pushes  the  STATUS  key,  the  aircraft  status  is  pre¬ 
sented  on  the  status  display.  By  selecting  the  STATUS  key  again,  the  FSM 
will  display  the  system  schematic  associated  with  the  first  procedural 
action  item. 


The  crew  reads  the  checklist  and  performs  the  necessary  actions  on  the 
overhead  panel.  If  there  Is  more  than  one  page  of  procedures,  the  com¬ 
pletion  of  the  Items  on  the  first  page  will  bring  up  the  next  page..  By 

repeated  pushing  of  the  CHECKLIST  key,  the  crew  may  step  through  the 

procedure  pages.  After  the  procedures  are  completed,  the  crew  may  step 

through  the  status  pages  by  pushing  the  STATUS  key.  After  completion  of 
the  checklist  procedures,  the  displays  will  be  cleared.  The  alert  message 
Is  removed  from  the  alert  display  If  the  alerting  situation  no  longer 
exists,  otherwise  It  may  be  cleared  by  line  selecting  the  alert  and  select¬ 
ing  STORE.  Selecting  STORE  will  store  all  alerts,  except  warning  level 
alerts  and  alerts  which  have  pending  checklists. 

2.4.2  Basic  Concept  with  Automatic  Display 

This  concept  is  the  same  as  the  Basic  concept  except  when  the  crew  pushes 
the  line  select  key,  the  procedures  display  and  status  display  (aircraft 
status  page)  will  be  brought  up  automatically  (see  Figure  2. 4. 2-1).  As  the 
crew  completes  all  the  procedures  on  a  page,  the  next  page  will  appear 
automatically.  After  the  procedures  are  completed,  the  crew  may  step 
through  the  remaining  status  pages.  .  ; 
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Figure  2.4. 1-1  The  Basic  Concept 
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Figwo  2.4.2- 1  The  Basic  Concept  (with  Auto  Display  Call-Up) 


2.4.3  Touch  Panel  Interactive  Concept 

This  concept  Is  Illustrated  In  Figure  2. 4. 3-1.  The  procedures  display  and 
status  display  (aircraft  status  page)  are  automatically  called  up  by  the 
pilot  selecting  the  line  address  key  on  the  alert  display.  The  pilot 
performs  the  actions  directly  on  the  status  display.  After  manually 
stepping  past  the  aircraft  status  page,  the  status  display  will  contain  a 
schematic,  related  to  the  first  action-item,  with  computer  generated  touch 
keys  to  reconfigure  the  system.  Feedback  Information  Is  presented  on  both 
the  procedures  and  status  displays.  Each  action  Item  will  have  a  corres¬ 
ponding  schematic  diagram  on  the  status  display.  This  display  Is  also 
touch  Interactive  for  calling  up  more  detailed  Information,  If  desired. 

2.4.4  Voice  Interactive  Concept 

This  concept,  shown  In  Figure  2. 4. 4-1,  uses  voice  for  both  messages  and 
control  of  the  displays  and  aircraft  systems.  Voice  control  actuation  Is 
optional,  and  both  the  displays  and  systems  may  be  manually  controlled  as 
described  under  the  Basic  or  Touch  Interactive  concepts.  Voice  messages 
are  used  to  direct  the  crew's  attention  to  alerts  and  to  the  actions  to  be 
performed  If  the  alert  Is  a  time-critical  alert. 

After  pushing  the  line  select  key,  the  pilot  may  select  voice  Interaction 
by  depressing  the  VOICE  key.  When  the  displays  are  called  up,  the  first 
action  Item  would  be  addressed.  To  execute  an  action  Item,  the  crew  says, 
for  example,  "PUMP  1  OFF"  and  an  execution  command,  and  the  action  Is 
completed.  The  crew  continues  this  process  until  all  the  procedures  are 
completed.  Feedback  Is  presented  visually  on  the  procedures  and  status 
displays  and  may  be  presented  by  voice  messages. 
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Figure  2.4.3 •  1  The  Touch  Panel  Interactive  Display 
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Figure  2.4.4- 1  The  Voice  Interactive  Display  Concept 


2.4.5  Multifunction  Keyboard  Concept 


This  concept  uses  a  multifunction  keyboard  with  programmable  keys  and  a 
scratchpad.  The  scratchpad  display  presents  the  alert  procedures.  Air¬ 
craft  status,  system  diagrams,  and  operational  information  are  shown  on  the 
status  display  as  in  the  other  concepts.  The  multifunction  keyboard  pre¬ 
sents  the  sequence  of  control  actions  by  having  the  legends  on  the  keys 
correspond  with  the  action  items  on  the  checklist.  This  concept  has  also 
been  termed  "Directed  Selection"  because  of  this  capability  to  present  the 
sequence  of  actions  to  be  taken  by  the  crew. 

The  operation,  as  illustrated  in  Figure  2.4.5-i,,  shows  that  after  line 
selecting  the  alert,  the  checklist  appears  on  the  scratchpad,  and  the 
actions  that  are  interactive  with  the  aircraft  systems  are  presented  in 
sequence  on  the  multi legend  keyboard.  To  perform  the  action  items,  the 
pilot  must  depress  the  corresponding  multifunction  key.  To  perform  actions 
that  are  not  interactive  with  the  aircraft  systems,  such  as  "CHECK  air¬ 
speed"  and  SET  altimeters",  the  pilot  does  the  action  and  then  indicates  to 
the  system  that  the  action  has  been  accomplished  by  selecting  a  dedicated 
buttor  labeled  DONE.  This  procedure  is  continued  until  all  items  are 
completed.  Feedback  is  provided  on  the  scratchpad,  on  the  multifunction 
legends,  and  on  the  status  display.  The  operation  of  the  checklist  on  the 
scratchpad  is  the  same  as  on  the  procedures  display  iised  in  the  other 
concepts. 

2.4.6  Automatic  Reconfiguration  Concept  . 

Any  of  the  systems-aided  concepts  could  incorporate  pilot-initiated  auto¬ 
matic  system  reconfiguration.  For  demonstration  purposes,  the  multifunc¬ 
tion  keyboard  concept  was  used  to  evaluate  the  feasibility  of  this  control 
method.  This  concept  requires  the  same  steps  to  call  up  the  checklist  on 
the  scratchpad  display  and  the  procedural  steps  on  the  keyboard.  However, 
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the  crew  has  only  to  select  one  key,  a  dedicated  key  labeled  EXECute,  to* 
initiate  the  corrective  action.  The  system  automatically  does  the  action 
Items  that  are  Interactive  with  the  aircraft  systems,  at  a  predetermined 
rate,  stopping  at  Items  that  must  be  accomplished  by  the  pilot.  Action  and 
status  feedback  are  presented  on  the  status  and  scratchpad  displays  (Figure 
2. 4. 6-1).  The  crew  has  the  option  to  stop  the  reconfiguration  at  any  time. 
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Figure  2. 4. 6- 1  The  A  utomatic  Reconfiguration  Concept 


3.0  SCENARIO  DEVELOPMENT 


3.1  OBJECTIVE 

The  primary  objective  for  the  simulated  flight  scenarios  is  to  provide  a 
realistic  test  situation  for  use  In  evaluating  FSM  system  candidate  con¬ 
cepts.  The  flight  scenarios  must  realistically  task  the  pilot  so  mean¬ 
ingful  data  can  be  obtained. 

3.2  APPROACH 

Several  qualifications  were  made  when  designing  the  scenarios.  First,  it 
Is  necessary  that  the  system  failures  and  the  adverse  operational  situa¬ 
tions,  which  are  the  bases  for  the  alerts,  can  be  sensed  via  the  aircraft 
and  Its  associated  sensor  system. 

Second,  it  Is  necessary  that  the  alerts  selected  and  the  sequence  of  events 
are  appropriate,  since  the  basic  purpose  of  the  study  is  to  demonstrate/ 
evaluate  the  functions  of  a  flight  status  monitor.  Not  all  pilots  will 
experience  every  alert  up  to  the  time-critical  situation.  Some  pilots  will 
accommodate  for  the  degrading  situation  early  In  the  scenario  and  never 
experience  a  high  level  alert.  However,  the  system  should  be  designed  to 
provide  continuous  monitoring  of  flight  conditions  from  simple  situations 
up  through  degraded  or  compounded  situations. 

Scenario  development  was  accomplished  in  three  steps.  First,  alerts  Iden¬ 
tified  in  Phase  IV  which  have  the  potential  for  improving  aircraft  safety 
were  selected.  Second,  candidate  system  concepts  to  handle  the  alerts  and 
present  them  to  the  crew  had  to  have  been  developed.  Third,  simulated 
flight  scenarios  were  designed. which  would  present  the  alerts  In  a 
realistic  flight  operation. 

Alert  selection  has  been  a  continuing  process,  the  survey  of  accidents  In 
Phase  IV  produced  a  list  of  alerts  which  appear  to  have  potential  benefit 


for  laproving  aircraft  safety.  The  study  showed  that  when  crew  error  was 
primary  cause,  approximately  61  of  the  accidents  resulted  from  navigation 
errors.  Therefore,  navigation  error  was  selected  as  an  alert  candidate  to 
be  provided  by  the  FSM.  Similarly,  other  alerts  were  derived  In  Phase  IV, 
Including: 


O  WIND/WINDSHEAR 
O  TIRE/WHEEL  FAILURE 

O  COLLISION  AVOIDANCE 

o  TAKEOFF  ABORT 

Outside  sources  suggested  other  alerts  for  the  list  or  supported  those 
already  on  the  list.  For  example,  the  FAA  suggested  an  alert  for  differen¬ 
tial  lift  across  an  aircraft's  wings.  Safety  experts  proposed  the  use  of 
tire  failure  and/or  Insufficient  acceleration  as  the  basis  For  a  takeoff 
abort  alert.  The  recent  reporting  of  Incidents  caused  by  fuel  shortage 
prompted  the  consideration  for  a  low  fuel  alert. 

Low-level  alerts  were  then  selected  which  might  indicate  the  early  states 
of  a  degrading  situation,  leading  up  to  a  condition/situation  which  might 
develop  Into  an  accident.  For  example,  a  stall  might  be  preceeded  by  a 
wing  asymmetry  alert,  and  an  abort  might  be  preceded  by  an  alert  for  low 
acceleration. 


The  list  of  the  alerts  considered  Is  provided  below: 


o  DIFFERENTIAL  LIFT 
o  ABORT 

.  O  TIRE  FAILURE 

O  NAVIGATION  ERROR 

0  LOW  FUEL 

0  INSUFFICIENT  BRAKING 
o  COLLISION  AVOIDANCE 
0  WINOSHFAR 

O  GROUNO  PROX 

0  STALL 

0  WING  ASSYHMETRY 

0  LOW  ACCELERATION 

0  ENGINE  ANTI-ICE 

0  ENGINE  VIBRATION 
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3.3  SCENARIO  DESIGN 


Three  simulated  flight  scenarios  were  developed  to  evaluate  the  preliminary 
FSM  concepts,  they  are: 

1.  Differential  Lift  -  An  approach  in  bad  weather  with  a  sequence  of 
events  which  lead  up  to  a  differential  lift  and  stall  situation. 

2.  Takeoff  Abort  -  A  take-off  situation  in  which  the  aircraft  fails 
to  achieve  sufficient  acceleration  and  the  system  signals  an  abort 
alert. 

3.  Navigation  -  An  enroute  cruise  situation  in  which  navigation 
errors  and  multiple  system  failures  occur. 

3.3.1  Differential  Lift  Scenario 


This  scenario  is  built  around  the  critical  flight  conditions  of  differen¬ 
tial  Tift.  The  pilot's  concern  Is  to  avoid  stalling  p  wing.  Therefore, 
the  highest  urgency-level  alert  in  the  scenario  Is  "STALL". 


To  provide  a  degree  of  realism  for  the  system  demonstration,  the  scenario 
has  included  several  alerts  which  might  be  pre-cursors  to  a  wing  stall. 
Those  selected,  in  order  of  their  occurrence  are: 


Alert 

Left  engine  anti-ice  failure 
Left  engine  vibration 
Left  engine  shutdown 
Leading  edge  slats  asymmetry 
Wing  stail 
Stall 


Assigned  Urgency  Level 
Caution 
Caution 
Caution 
Caution 
Warning 
Time-Critical 


Normally,  engine  anti-ice  failure  is  only  an  advisory-level  alert,  but  the 
FSM  has  in  its  data  file  that  icing  conditions  exist  so  it  elevates  the 
alert  level  to  caution. 


These  alerts  are  woven  into  a  theoretical  flight  from  Chicago  to  Boston  in 
adverse  weather.  Enroute  to  Boston  the  crew  is  told  to  hold  for  traffic 
metering  and  must  change  landing  runway  because  of  a  wind  shift.  Task 
workload  Is  provided  by  the  combination  of  the  ATC  communications,  the 
landing  runway  change,  the  flight  control  difficulties  due  to  the  bad 
weather  with  light  turbulehce,  and  the  sequence  of  failures.  Figure 
3. 3. 1-1  shows  a  simplified  profile  of  this  simulated  flight  scenario. 

3.3.2  Takeoff  Abort  Scenario 

This  scenario  demonstrates  how  the  FSM  could  be  used  to  aid  the  pilot  In 
the  critical  takeoff  flight  phase.  It  Is  generally  considered  that  takeoff 
Is  more  demanding  on  the  aircraft  than  on  the  pilot.  The  pilot  has  two 
tasks:  to  decide  to  continue  the  takeoff  and  to  guide  the  aircraft  Into 
the  air.  However,  because  of  the  many  factors  In  the  decision  process  and 
the  time-critical 1 ty  of  the  decision,  computer-aided  decision-making  by  the 
FSM  could  aid  pilot  performance. 

The  scenario  shown  In  Figure  3. 3. 2-1  will  be  a  short  sequence  of  events, 
during  a  flight's  departure,  which  will  lead  to  a  takeoff  abort  alert. 
Several  conditions  will  be  set  In  the  simulator  which  will  hinder  normal 
acceleration.  These  Include:  simulation  of  snow  and  slush  on  the  runway, 
low  tire  Inflation,  up  slope  of  the  runway,  and  a  heavy  aircraft.  During 
this  scenario,  the  pilot  could  fall  to  set  full  takeoff  thrust  and  be  slow 
In  deciding  to  abort.  It  Is  anticipated  that  these  conditions,  coupled 
with  the  weather  and  delayed  decisions  may  lead  to  the  FSM  calling  for  an 
abort.  Precursor  alerts  for  low  acceleration  will  be  provided  at  the 
advisory,  caution,  and  warning  levels  before  the  time-critical  abort  alert 
is  presented.  If  the  pilot  cannot  correct  for  the  lower  level  alerts,  he 
would  probably  abort  the  takeoff  before  the  abort  alert  Is  given.  While 
this  would  be  less  dramatic.  It  will  still  demonstrate  the  system  capabi¬ 
lity  to  aid  the  pilot  by  providing  guidance  for  this  potentially  critical 
situation. 


Figure  3.3.1 -1  Differential  Lift  Scenario 


Figure  3.3.2- 1  Takeoff  Abort  Scenario 


3.3.3  Navigation  Error  Scenario 


This  scenario  will  be  a  sequence  of  events  which  may  lead  to  a  ground 
proximity  time-critical  alert.  The  scenario  will  Include  a  multiple  alert 
situation  to  demonstrate  the  capability  of  the  FSM  to  handle  these  complex 
and  often  critical  situations.  Two  system  failures,  a  hydraulic  and  an 
electrical  failure,  will  be  Initiated.  The  FSM  will  prioritize  the  two 
sets  of  procedures  and  Integrate  them  Into  a  single  procedure  for  the  pilot 
to  handle. 

A  predictive  low  fuel  alert  will  be  Included  In  the  scenario  to  demonstrate 
the  potential  for  the  use  of  "expert  systems"  in  the  design  of  the  FSM.  It 
Is  Intended  to  take  advantage  of  the  capabilities  of  knowledge-based  sys¬ 
tems  and  the  ever-increasing  amount  of  microprocessor-based  Information 
that  Is  available  on  the  aircraft.  The  use  of  expert  systems  addresses 
many  of  the  requirements  ter  future  crew  alerting  systems  as  suggested  In 
Phase  IV,  such  as  a  greater  number  of  sensor  Inputs,  greater  flexibility, 
the  need  to  handle  mutlple  anomalous  events,  and  the  need  to  respond  to 
specifics  of  the  various  flight  phases. 

The  navigation  error  scenario  Is  Illustrated  In  Figure  3. 3.3-1.  The  simu¬ 
lated  flight  depicts  the  final  legs  of  a  flight  from  Phoenix  to  Salt  Lake 
City,  In  darkness  and  frontal  weather.  To  Impose  a  high  pilot  workload, 
frontal  weather  with  turbulence,  wind  shifts,  and  darkness  will  be  simu¬ 
lated.  The  pilot  will  also  handle  flying  duties  as  well  as  comply  with  ATC 
communications  and  holding  requirements.  Multiple  system  failures  will 
occur.  It  Is  anticipated  that  the  pilots  might  drift  off  course  causing  a 
low  level  navigation  error  alert.  Some  pilots  may  also  receive  an  alert 
for  a  major  navigation  error.  For  some  pilots,  the  navigation  will  degrade 
until  a  ground  proximity  time-critical  alert  Is  triggered. 


Figure  3. 3.3-1  Navigation  Error  Scenario 


4.0  DEMONSTRATION  PLAN 


4.1  OBJECTIVE 

The  objective  of  the  demonstrations  was  to  obtain  feedback  and  comments 
from  pilots  and  engineers  to  refine  the  preliminary  FSM  concepts.  Feedback 
obtained  from  these  demonstrations  will  be  the  major  source  of  Information 
for  refining  the  candidate  concepts  to  be  evaluated  In  Phase  II. 

4.2  APPROACH 

Two  concept  demonstrations  were  conducted  In  Phase  I.  In  the  first  demon¬ 
stration,  the  study  team  members  and  the  FAA  contract  monitor  reviewed  the 
Initial  set  of  FSM  functions  Implemented  In  the  simulator.  In  the  second 
demonstration,  six  pilots  were  led  through  the  Differential  Lift  scenario. 
For  this  demonstration  both  the  Basic  and  Basic  with  Automatic  Display 
concepts  were  Implemented  In  the  simulator.  In  addition,  the  system-aided 
and  automated  concepts  were  discussed  to  obtain  pilot  comments  and  feed¬ 
back. 

Additional  team  demonstrations  will  be  conducted  early  In  Phase  II,  after 
the  system-aided/automated  concepts  are  Implemented  In  the  simulator.  With 
the  demonstrations,  the  FSM  concept/design  Issue  questionnaire  will  be 
administered  to  validate  Its  design.  The  questionnaire  1$  contained  In 
Appendix  B.  — - 

4.3  SIMULATION  FACILITIES 

4.3.1  Mock-up  and  Integration  Laboratory 

The  Mock-up  and  Integration  Laboratory  at  the  Boeing  Commercial  Airplane 
Company's  Development  Center  was  used  to  develop  and  demonstrate  the  FSM 
concepts  (see  Figure  4. 3. 1-1). 
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The  Mock-up  and  Integration  Laboratory  provides  R  A  D  capability  for 
developing  advanced  flight  decks.  The  laboratory  Is  used  for:  (1)  early 
laboratory  work  requiring  use  of  bench  development  and  test  facilities,  (2) 
successive  stages  of  part  task  simulation  using  simplified  approximations 
of  sensor  and  aircraft  systems,  and  (3)  concept  Implementation  In  a  cockpit 
simulator  to  confirm  appropriateness  of  Interface  provisions  and  operations 
before  flight  test. 

4.3.2  Research  Cab 

The  center  of  the  lab  Is  a  new  generic  wldebody  fiberglass  aircraft  cock¬ 
pit.  The  cab  has  been  designed  to  be  easily  reconflgur&ble  and  can  be 
configured  for  two  or  three  (forward  facing)  crew  members.  All  the  dis¬ 
plays,  their  control  panels,  mode  switches,  control  display  units  and 
flight  controls  are  mounted  In  the  cab. 

The  cab  serves  a  dual  purpose.  First,  It  provides  a  facility  to  appraise 
the  requirements  for  an  Individual  display  or  control.  Including  the  dis¬ 
play  content  and  format:.  Secondly,  the  cab  provides  the  capability  to 
perform  system  Integral  on  work  to  support  the  development  of  new  display 
or  control  systems. 

The  cab  Is  equipped  with  state-of-the-art  color  displays.  Figure  4. 3.2-1 
shows  the  flight  deck  with  the  EADI  and  EHSI  surrounded  by  four  CRTs  pre¬ 
senting  secondary  Instrument  Information.  The  center  Instrument  panel 
contains  four  CRTs,  two  of  which  present  engine  Instrument  data.  The  two 
CRTs,  shown  blank,  are  being  used  to  present  emergency  procedures  and 
status  Information  for  the  FSM. 

Figure  4. 3. 2-2  shows  the  cab  displays  which  will  be  used  for  the  FSM  demon¬ 
strations.  On  the  left  Is  the  visual  Information  display,  also  called  the 
alert  display  or  alphanumeric  display.  The  displays  to  the  right  of  the 
alert  display  are  the  procedures  and  status  displays,  respectively. 
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Figure  4. 3. 2-2  Flight  Status  Monitor  Displays 


At  the  bottom  of  the  picture,  on  the  center  aisle  stand  Is  the  system 
action  panel  with  Its  15  programmable  keys.  During  test,  this  panel  serves 
as  a  substitute  for  the  airplane's  system  controls,  usually  located  on  the 
overhead  panel.  The  panel  also  serves  as  the  control  panel  for  the  "Multi¬ 
function  Keyboard"  candidate  FSM  concept. 

The  alert  display  uses  11  lines  of  16-character  alphanumerlcs  to  provide: 

o  One  location  where  all  warning,  caution  and  advisory  messages  are 
displayed 

o  A  concise  alert  message  for  each  problem 
o  Information  about  alert  urgency 
o  Some  direction  for  crew  corrective  actions 
o  Feedback  to  crew  when  faults  are  corrected 
o  Line  select  and  function  selection  of  display  formats. 

The  checkll st/procedures  display  and  the  status/schematics  display  are  6  x 
7  inch  Collins  shadow-mask  CRTs.  They  provide  a  7-color  repertoire  In 
alphanumeric  or  graphic  format. 

4.3.3  System  Design 

The  FSM  display  and  control  system  Is  Independent  of  the  research  cab,  so 
that  It  may  operate  In  other  simulators.  Toward  this  end,  tie  system 
design  Is  autonomous  from  the  Boeing  simulator,  except  for  simulated-air¬ 
craft  system  status  data.  A  direct  result  of  this  design  philosophy  Is 
that  the  FSM  must  contain  all  the  functions  and  capabilities  for  handling 
crew  alerting;- Including  alert  categorization,  prioritization,  and  Inhibi¬ 
tion  schemes,  algorithms  for  handling  heuristic  systems  data,  checklist  and 
procedural  schemes,  status  display,  and  a  variety  of  system  control 
paradigms. 
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Figure  4. 3. 3-1  shows  a  functional  diagram  of  the  FSM  system.  On  the  far 
right  of  the  figure  are  the  system-pilot  Interfaces,  the  display-control 
devices.  On  the  far  left  the  airplane  host  simulator  function  is  shown. 
To  the  right  of  the  host  simulator  Is  the  large  monitor  and  control  unit 
labeled  the  FSM  Emulator.  The  monitor  and  control  unit  is  the  basic  FSM 
unit.  Between  the  monitor  and  the  system-pilot  Interface  devices  are 
'-ontrol  modules  which  execute  the  commands  of  the  controller  and  control 
the  display  devices.  They  also  modulate  the  pilot  control  actions  affect 
Ing  the  monitor. 

4.4  DEMONSTRATION  PROCEDURES 


As  mentioned  in  Section  4.2,  two  demonstrations  were  conducted  during  Phase 
I.  The  procedures  were  the  same  in  both  demonstrations  and  are  described 
In  Paragraph  4.4.1. 

4.4.1  FSM  Study  Team  Demonstration 

The  system  was  demonstrated  with  a  static  airplane  simulator  using  the  test 
scenario  for  Differential  Lift.  The  sequence  of  system  operation  was  con¬ 
trolled  by  microprocessors  which  permitted  test  conductor  Interaction  with 
the  alert  display  and  the  procedures  and  status  displays.  The  Basic  FSM 
concept  was  demonstrated.  The  test  conductor  performed  the  demonstrations, 
allowing  the  test  subjects  to  observe  and  critique  the  concepts. 

■  The  "LEFT  ENGINE  ANTI-ICE"  alert  (shown  In  Figure  4.4. 1-1)  was  presented 
first.  The  test  conductor  pressed  the  appropriate  line  select  key,  which 
called  up  a  note  on  the  procedures  display  stating  that  there  was  no  pro¬ 
cedure  for  the  alert.  The  test  conductor  then  selected  STATUS  on  the  alert 
display,  which  caused  the  anti -Ice  system  dlagrant  to  appear,  as  shown  In 
Figure  4.4. 1-2.  Subsequent  selections  of  the  STATUS  key  called  up  the 
operational  Information  shown  In  Figures  4. 4. 1-3  and  4.4. 1-4.  Then,  fol¬ 
lowing  a  simulated  scenario  of  flying  In  Icing  conditions,  a  new  alert  was 
generated  and  presented  on  the  alert  display:  "L  ENGINE  VIBRATION".  The 
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Figure  4. 3 . 3.  -1  Functional  Diagram  of  the  FSM  S  yctem 
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test  conductor  pushed  the  line  select  and  checklist  keys,  and  the  alert 
procedures  were  presented  on  the  procedures  display  (as  shown  In  Figure 

4. 4. 1- 5).  The  test  conductor  read  the  displayed  information  and 
accomplished  the  engine  shutdown  procedure  using  the  system  action  panel. 

As  each  step  was  accomplished,  the  action  Item  on  the  procedures  list  would 
change  from  white  to  green  and  a  cursor  would  drop  down  to  the  next  pro¬ 
cedural  Item.  When  the  checklist  was  completed,  the  display  was  cleared. 

Then  the  test  conductor,  who  was  demonstrating  the  display  of  a  preliminary 
landing  checklist,  was  given  an  alert  that  his  Left  Leading  Edge  Slats  did 
not  deploy,  "LE  SLATS  ASYM".  Upon  pressing  the  line  select  key  and 
selecting  CHECKLIST,  the  procedure  for  the  alert  came  up  as  shown  in  Figure 

4.4. 1- 6.  Using  the  system  action  panel  (Figure  4.4. 1-7)  the  test  conductor 
accomplished  the  checklist. 

After  the  checklist  had  been  completed,  the  test  conductor  selected  STATUS 
and  the  aircraft  status  came  up  on  the  status  display  (see  Figure  4. 4. 1-8). 
Then,  because  of  loss  of  airspeed,  a  warning-level  alert  was  presented  on 
the  alert  display,  "WINGS  ASYMMETRY".  The  test  conductor  selected  the 
alert  and  selected  CHECKLIST,  see  Figure  4. 4. 1-9).  The  test  conductor 
checked  his  airspeed  and,  using  the  system  action  panel  (Figure  4.4.1-10) 
pr.hed  the  "DONE"  button  to  indicate  completion  of  the  procedural  step. 

Although  not  dynamically  demonstrated,  the  scenario  would  have  continued 
with  a  further  loss  of  airspeed  causing  a  time-critical  alert  on  the 
glareshl eld-mounted  time-critical  display: 

"STALL"  "ADD  POWER" 

The  scenario  would  have  ended  with  the  pilot  responding  to  the  alert  by 
adding  power. 

Throughout  the  demonstration,  the  study  team  members  and  the  contract 
monitor  commented  on  specific  FSM  design  features.  A  summary  of  these 
comments  are  contained  In  Section  4,r.l. 


Figure  4.4. 1  -5  Left  Engine  Vibration  Alert  Procedures 
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Figure  4.4.1  *7  System  Action  Pane i 


Figure  4.4. 1  -8  Aircraft  Status  Display 
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figure  4.4.1 -  /O  System  Action  Pent! 


4.4.2  Pilot  Demonstration 


On  April  13,  1984,  six  pilots  participated  In  a  demonstration  of  the  Basic 
and  the  Basic  With  Automatic  Display  concepts  In  the  Boeing  simulator.  All 
of  the  pilots  were  qualified  In  at  least  three  aircraft  and  had  between 
4,500  add  14,000  pilot  hours  with  an  average  of  8,333  hours. 

Before  the  demonstrations,  the  pilots  were  briefed  on  the  objectives  and 
functions  of  the  FSM  and  on  the  candidate  concepts.  The  concepts  were 
described  In  detail,  and  crew  interaction  with  the  system  was  explained. 
Questions  and  comments  were  solicited  from  the  pilots  during  the  briefing. 
Following  the  briefing  the  pilots  were  shown  the  research  cab  and  were 
Instructed  as  to  how  the  demonstration  would  be  conducted.  They  were 

i  , 

Informed  that  the  session  was  being  tape  recorded  and  were  asked  to  speak 
up,  as  the  noise  level  In  the  cab  would  be  high.  They  were  asked  to  stop 
the  demonstration  at  any  time  to  repeat  or  discuss  any  feature  of  the 
system.  The  test  conductor  solicited  questions  and  comments.  The  scenario 
and  FSM  concepts  demonstrated  were  the  same  as  those  described  for  the 
first  demonstration  In  Paragraph  4.4.1.  Again,  the  test  conductor  per¬ 
formed  the  demonstrations,  allowing  the  pilots  to  observe  and  critique  the 
concepts. 

Once  initiated,  the  operation  of  the  FSM  was  paced  by  controlled  inputs 
from  the  tes;t  conductor  (who  narrated  the  scenario).  As  questions  came  up 
or  a  discussion  broke  out,  the  test  conductor  would  delay  the  next  control 
Input  to  permit  full  discussion.  The  objective  was  to  get  the  pilots' 
opinions  on  the  candidate  concepts. 

Following  the  demonstration,  a  transcript  of  the  tape  was  made  and  analyze 
ed.  A  summary  of  these  comments  Is  contained  1r  the  next  section. 

4.5  DEMONSTRATION  RESULTS 

The  results  of  the. study  team  and  pilot  demonstrations  are  summarized 
separately  below. 
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4.5.1  Study  Team  Demonstration  Results 


Review  of  the  demonstration  cdncepts  and  scenario  led  to  a  consensus  for 
the  following  refinements  in  preliminary  concepts: 

o  Increase  size  of  characters  on  check! i st/procedures  display. 

o  Color  code  failed/degraded  components  on  schematic  diagrams  with 
the  same  color  as  the  urgency  lever  of  the  alert. 

o  Information  on  the  procedures  display  should  be  directive  and 
positive.  For  example,  it  is  better  to  use: 

•'Maintain  155  KTS  airspeed",  instead  of 

"Check  airspeed - check" 

o  On  aircraft-level  schematics,  only  color-code  failed  systems/ 
components  due  to  the  small  size  of  the  display. 

4.5.2  Pilot  Demonstration  Results 

The  following  comments  were  derived  from  the  analysis  of  the  pilot  demon¬ 
stration  transcript.  The  comments  listed  are  those  made  by  one  or  more  of 
the  pilots.  In  general,  most  of  the  comments  were  derived  on  the  content 
and  format  of  the  procedures  and  status  displays  and  on  the  level  of  auto¬ 
mation;  the  following  comments  are  reported  in  that  respective  order.  The 
pilot's  suggestions  will  be  considered  along  with  the  literature  review 
results  and  questionnaire  feedback,  during  the  refinement  of  Phase  I 
concepts. 

4. 5. 2.1  Procedures  Display  Comments 

o  Completed  action  items  should  remain  displayed  until  the  entire  pro¬ 
cedure  is  completed.' 


o  Completion  of  the  procedure  should  be  acknowledged  by  the  crew  before 
the  action  items  are  cleared  from  the  display. 

o  Procedural  action  items  presenvri  "up  front"  was  preferred.  It  would 
also  make  one  less  book  to  carry  around. 

o  Although  displayed  procedures  were  favored,  electronic  checklists  could 
pose  a  problem  when  ai rworthi ness  recti ves  require  a  change  in  proce¬ 
dures,  because  of  the  complexity  and  security  of  software  changes. 
Current  paper  checklists  are  easily  altered. 

o  A  comoletely  modifiable  checklist,  needed  to  avoid  the  problem  of 

changing  a  checklist  and  conforming  to  a  software  verification  require¬ 
ment,  would  be  a  formidable  task. 

4. 5. 2. 2  Status  Display  Comments 

o  Pilots  stated  that  the  display  of  aircraft  level  status  did  not  extend 
their  knowledge  of  the  aircraft's  condition.  For  example,  "If  a  pilot 
needs  a  picture  to  tell  him  that  the  Left  Leading  Edge  Slat  Is  not 
extended,  he  has  got  a  problem." 

o  There  Is  no  need  to  display  systems  diagrams  with  failed  components  If 
the  flight  crew  cannot  repair  them. 

o  Aircraft  level  status  displays  should  sho.v  maximum  and  minimum  speed 
limits 

o  Studying  the  status  display  will  cause  the  pilots  to  keep  their  heads 
down,. 

o  Status  display  would  not  help  the  pilot  respond  to  alerting  situations. 

o  The  use  of  status  or  grapnic  displays,  like  those  demonstrated,  have 
never  been  as  useful  as  envisioned.  Pilots  stated  that  in  general, 
they  need  to  be  Improved  and  that  more  format  development  was  needed. 
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4. 5. 2. 3  "Level  of  Automation11  Comments 


o  For  warning  level  alerts,  the  procedures  and  status  displays  should 
come  up  automatically. 

o  In  general,  the  pilots  favored  automatically  executed  checklists,  but 
they  wanted  the  capability  to  select  the  AUTOMATIC  mode. 

o  The  pilot  must  have  the  capability  to  halt  the  automatic  completion  of 
a  checklist. 

o  Regardless  of  the  design,  the  pilot  must  always  retain  control  over  the 
aircraft. 

o  Automatic  checklist  might  be  beneficial  when  the  flight  envelope  Is 
reduced  through  some  failure  In  the  flight  control  augmentation  system. 

o  Allow  the  pilot  to  control  the  length  of  time  between  the  execution  of 
action  Items  on  automatically  completed  checklists. 

o  With  a  turbine  shaft  shear  there  could  be  as  little  as  2/5  of  a  second 
to  shut  down  an  engine.  In  such  a  case,  manual  shutdown  is  too  slow, 
and,  without  major  structural  encasement,  automatic  shutdown  Is 
required. 

4. 5.2.4  Voice  Message  Comments 

o  A  smart  system  should  Include  voice  messages  as  a  redundant  mechanism 
for  providing  crew  guidance  and  feedback  in  responding  to  alerting 
situations. 

o  A  voice  message  such  as  "NOSE  DOWN"  or  "ADD  POWER"  might  help  the  crew 
in  situations  like  those  encountered  in  the  Chicago  accident. 


5.0  ACCOMPLISHMENTS  AND  RECOMMENDED  FUTURE  ACTIVITIES 


5.1  SUMMARY  OF  ACCOMPLISHMENTS 


The  following  major  tasks  were  accomplished  during  Phase  I: 

1.  FSM  System  Requirements  -  Based  on  the  sesults  of  Phase  IV,  an 
approach  was  taken  "to  expand  the  alerting  system  to  function  as  an 
FSM.  FSM  functional  requirements  were  developed  on  the  assumption 
that  by  providing  flight  crews  with  procedural  guidance  informa¬ 
tion  and  feedback  crew  performance  in  non-normal  situations  could 
he  improved. 

2.  \  *  Control  and  Display  Requirements  -  Candidate  control  and 
<flsplay  suites  were  identified  to  satisfy  the  FSM  functional 
requirements.  Information  requirements  can  be  accommodated  by  one 
or  more  color  displays.  In  our  present  configuration,  two  color 
displays  are  used;  one  provides  step-by-step  procedures  for 
resolving  aircraft  alerting  situations  and  one  provides  aircraft 
and  system  status.  To  satisfy  the  control  requirements  for  inter¬ 
acting  with  the  FSM  and  accomplishing  the  procedural  action  items, 
several  candidate  concepts  were  identified  including:  voice 
control,  touch-interactive  displays,  multifunction  keyboard,  and 
automatic  reconfiguration. 

3.  FSM  Implementation  Issues  -  For  each  of  the  candidate  control  and 
display  suites  identified  above,  implementation  issues  were  ad¬ 
dressed.  Basically,  these  Issues  focused  on  identifying  all  of 
the  design  questions  relating  to  the  content,  format  and  crew 
interaction  mechanisms  for  Implementing  the  candidate  FSM  con¬ 
cepts. 

4.  Candidate  System  Concepts  -  System  concepts,  differing  In  their 
level  of  automation,  were  developed  for  satisfying  the  FSM  re¬ 
quirements.  These  concepts  ranged  from  manual  control  through 
system  aided  control  and  finally  to  automatic  system  reconfigura¬ 
tion.  A  total  of  six  concepts  were  developed:  Basic  (manual 
control),  Basic  with  Automatic  Display,  Touch- Interactive,  VOice- 
Interactive,  Multifunction  keyboard  with  scratchpad,  and  Automatic 
reconfiguration.  ■ 

5.  Demonstration  Seer  yi  os  -  Scenarios  were  developed  to  provide  a  , 
mechanism  for  demunstrating/evaluatlng  the  candidate  system  con¬ 
cepts.  The  st^ry  lines  for  the  scenarios  were  abstracted  from 
accidents  >J  incidents  that  were  reviewed  as  part  of  the  Phase  IV 
effort.  Three  scenarios  were  developed:  (1)  Differential  Lift, 

(2)  Takeoff  Abort,  and  (3)  Navigation  Error. 


6.  FSM  Concept  Evaluation  -  Two  FSM  concept  demonstrati ons/evalua- 
tions  were  conducted.  The  study  team  members  and  the  FAA  contract 
monitor  participated  In  the  first  demonstration,  and  six  Boeing 
pilots  participated  in  the  second  demonstration.  The  demonstra¬ 
tions  were  conducted  in  Boeing's  flight  station  research  and 
development  laboratory.  The  demonstration  consisted  of  a  test 
conductor  going  through  the'  simulated  Differential  Lift  scenario 
with  the  Basic  (manual  control)  concept  implemented  in  the  sce¬ 
nario.  Whereas  only  the  Basic  concept  was  implemented,  all  other 
control  concepts  were  reviewed.  During  the  demonstrations,  par¬ 
ticipants  comments  and  opinions  were  solicited  to  provide  informa¬ 
tion  for  refining  the  candidate  concepts. 

7.  Candidate  Concept  Refinement  -  In  addition  to  the  system  demon- 
strations,  a  literature  review  and  a  questionnaire  were  developed 
to  provide  data  for  refining  the  candidate  concepts.  The  litera¬ 
ture  review  focused  on  resolving  the  candidate  concept  implementa¬ 
tion  Issues.  The  questionnaire  was  directed  at  evaluating  the 
relative  effectiveness  of  the  candidate  concepts  and  evaluating 
specific  design  features  of  each  concept.  The  questionnaire  will 
be  adninistered  early  in  Phase  II  to  provide  data  for  finalizing 
the  FSM  candidate  concepts  for  further  test  and  evaluation. 


5.2  RECOMMENOED  FUTURE  ACTIVITIES 


5.2.1  Continuation  of  Phase  I 

In  the  course  of  the  Phase  I  effort  it  was  decided  that  additional  data 
will  be  required  to  supplement  the  information  acquired  from  the  literature 
review  and  system  demonstrations  to  refine  and  reduce  the  number  of  candi¬ 
date  concepts  for  the  Phase  II  effort.  To  help  acquire  this  data,  a  ques¬ 
tionnaire  was  developed  which  will  be  administered  early  in  Phase  II.  In 
addition,  one  or  mere  system  demonstrations  will  be  conducted.  , 

5.2.2  Phase  II  Activities 


The  objective  of  Phase  II  is  to  implement  selected  FSM  functional  concepts 
in  special  test  hardware  and  evaluate  them  In  a  simulated  operational 
environment.  The  major  activities  to  be  accomplished,  in  Phase  II  are 
summarized  below. 


Develop  FSM  Simulation  Specifications  -  The  objective  of  this  task 
shall  be  to  Incorporate  the  changes  In  FSM  functional  concepts. 
First,  the  system  specification  will  be  modified  to  incorporate 
the  functional  changes  derived  from  the  Phase  I  demonstrations. 
Appropriate  changes  recommended  by  the  observers  of  the  concept 
demonstration  will  be  implemented. 

Secondly,  and  more  significantly,  the  concept  system  to  be  exer¬ 
cised  and  evaluated  in  Phase  II  will  be  a  more  complete  system. 
More  alerts  for  a  broader  range  of  alerting  functions  will  be 
Implemented.  Many  functions  previously  handled  by  the  host  com¬ 
puter  for  the  Phase  I  demonstration  will  be  designed  Into  the  FSM 
real-time  test  configuration. 

In  addition,  the  test  plans  and  the  simulation  scenarios  will  be 
altered  to  meet  the  requirements  for  the  Phase  II  evaluation. 
Scenarios  and  equipment  will  be  changed  as  necessary  to  permit 
accumulation  of  pilot  performance  and  preference  data. 

Develop  Simulator  Demonstration  Systems  -  Suitable  hardware  shall 
be  assembled  for  the  Phase  II  evaluation  In  an  operational  simu¬ 
lator.  Hardware  subsystems  will  be  configured  and  reprogrammed  to 
perform  functions  which  were  either  not  demonstrated  In  Phase  I  or 
were  accomplished  by  the  host  computer.  Necessary  interfaces  will 
be  modified  to  link  the  system  to  the  flight  simulator.  Wherever 
possible,  the  special  test  equipment  will  be  of  a  quality  capable 
of  flight  evaluation. 

Prior  to  Installation  In  the  simulator,  the  system  components 
shall  be  bench  tested  to  Insure  proper  operation.  This  task  will 
Include  testing  of  subcomponents  of  the  special  test  equipment  as 
they  are  reconfigured.  Additionally,  as  more  subassemblies  and 
capabilities  are  added  to  the  test  system,  operational  tests  will 


be  performed  to  ensure  operability  ar.d  compatibility.  When  avail¬ 
able,  the  complete  test  assembly  will  be  bench  tested  as  complete¬ 
ly  as  possible,  before  installation  in  the  simulator. 

The  test  equipment  shall  be  installed  and  its  operation  in  the 
flight  simulator  will  be  verified.  Because  not  all  functional 
tests  can  be  accomplished  on  the  bench,  extensive  testing  may  be 
required  when  the  test  equipment  is  installed  in  the  simulator. 
This  testing  will  Include  subassembly  testing,  such  as  the  aural 
signal  generator,  the  displays,  and  the  data  collection/ input 
devices. 

The  complete  system  will  be  tested.  The  simulator  elements  such 
as  the  cockpit  displays  and  controls  and  the  simulator  handling 
qualities  will  be  checked  out.  Finally,  the  concept  system  will 
be  pre-tested  in  test  scenarios  under  test  conditions.  Prior  to 
conducting  the  actual  test  and  evaluation,  a  limited  number  of 
sample  tests  will  be  conducted  to  assess  the  reliability  of  the 
system  and  to  solidify  test  procedures  and  the  test  schedule. 

This  task  will  Involve  approximately  40  hours  of  simulator  time. 

Perform  Demonstration/Test  and  Evaluation  -  Test  shall  be  perform¬ 
ed  using  suitable  subject  pilots.  This  task  will  involve  approxi¬ 
mately  60  hours  of  testing  in  t1*?  flight  simulator.  The  tests 
will  be  conducted  In  accordance  with  the  detailed  test  plan.  The 
test  subjects  will  be  selected  according  to  the  test  plan,  and 
shall  be  line  qualified  pilots.  Both  contractor  $md  subcontractor 
personne"  shall  provide  representation  at  the  tests  to  assure  the 
tests  are  conducted  according  to  plan,  to  assist  in  the  conduct  of 
the  tests,  and  to  facilitate  the  data  reduction  and  analysis. 
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APPENDIX  A 


DETAILS  OF  DISPLAY-CONTROL  SYSTEM  OPERATION 
(FROM  LITERATURE  REVIEW) 


Gartner  and  Holzhausen  (1979),  page  13 

Checklist  access  and  completion  steps: 

1.  The  main  dispatcher  (menu)  is  displayed.  The  operator  has  access 
to  any  mode  from  this  keypad  .-  he  chooses  "CHK"  for  "checklist-  by 
touching  the  "CHK"  switch. 

2.  The  Checklist  subdispatcher  (sub-menu)  appears  arid  the  main 
dispatcher  disappears.  The  operator  Identifies  the  desired 
procedure  by  touching  the  associated  switch  (such  as  "PFL"  for 
"pre-flight*  checklist). 

3.  The  first  page  of  the  desired  checklist  comes  up.  The  operator 
Indicates  a  completed  Item  by  touching  the  switch  next  to  that 
Item,  thus  each  Item  of  the  procedure  has  a  switch  associated  with 
It. 

4.  After  completion  of  a  page,  the  next  page  automatically  appears  on 
the  display. 

The  authors  did  not  discuss  what  transpires  after  the  procedure  has 
been  completed,  but  they  did  mention  that  the  user  can  return  to  the  main 
dispatcher  at  anytime  during  the  procedure  by  touching  the  "HOM"  key,  which 
remains  on  the  display  throughout  the  exercise. 

Streeter,  Weber,  and  Oplttek  (1973),  page  13 

Manual  and  automatic  progression  through  data  levels: 

The  pilot  could  call  up  a  schematic  diagram  or  checklist  procedure 
manually  In  one  of  two  ways;  step-by-step  through  all  data  levels,  or  by 
direct  access  to  the  desired  level.  Each  line  of  data  would  have  a  number 
associated  with  It,  left  of  the  line  iters  (see  Figure  A-lh  The  operator 
would  touch  the  line  number  to  see  more  detailed  information  pertaining  to 
that  specific  line,  thus  moving  through  all  data  levels.  Otherwise,  the 
controls  at  the  bottom  of  the  display  Would  be  used  for  direct  *'~ess  to 


LDG  GEAR 

V  up 

WING  SWEEP 

V  35  AUTO 

SL/FL/SPD  BR  V  10/35/UP 

FLT  CNTLS 

V  SAS 

FUEL 

V  SQOO 

ELECT 

V  NORM 

HYD 

-►  3000 

NAV/COMM 

V  NORM 

FLT  INST 

V  NORM 

CAB  ALT 

V  SOOO 

ARM/AWCS 

V  CFF/RDR 

CHECKLISTS 

SYSTEM 


SUB¬ 

SYSTEM 


SCHE¬ 

MATIC 


PROCE¬ 

DURE 


Figure  A-1  Checklist  Procedure  with  Associated  Une  Numbers  (Streeter,  et  at,  19731 


other  levels,  specifically  to  a  schematic  or  checklist  procedure.  Auto¬ 
matic  access  to  checklist  procedures  would  be  provided  for  warning-level 
conditions.  When  a  warning  was  sensed,  the  appropriate  procedure  would  be 
displayed  Imnedlately.  In  the  event  that  more  than  one  warning-level  alert 
had  occurred,  the  highest  priority  procedure  (as  determined  by  the  system 
logic)  would  be  presented. 

A  fourth  method  would  be  available  only  for  checklist  selection.  The 
word  "checklist"  would  appear  at  the  bottom  of  the  status  display.  Activa¬ 
tion  of  the  "checklist"  line  would  cause  a  checklist  Index  to  appear.  The 
operator  could  then  choose  the  desired  checklist  procedure. 

Sexton  (1983),  page  15 

Normal  and  abnormal  checklist  operations: 

Checklist  operations  were  described  for  both  normal  and  abnormal 
situations.  The  process  is  essentially  the  same,  except  for  the  call-up  of 
procedures.  In  both  cases,  checklists  are  presented  at  the  top  of  the 
display  and  schematic  diagrams  at  the  bottom  (see  Figure  A-2).  Dedicated 
touch  panel  controls  for  checklists  Included: 

Abnormal  Checklist  (ABN) 

Emergency  Checklist  (EMER) 

Normal  Checklist  (NORM) 

Index  (INOX) 

Page  Advance  (ADV) 

Page  Reverse  (REY) 

Clear  Checklist  (CLR) 

Checklist  Incomplete  (CHECKLIST  INCOMP) 

The  operation  of  a  "normal"  procedure  will  be  described  first,  fol¬ 
lowed  by  the  operation  of  an  "abnormal"  procedure. 

i 

NORMAL  PROCEDURE  CHECKLIST  OPERATION 

o  Initial  power  application  causes  the  first  sequenced  checklist  to 
appear. 


I 


o  Each  Item  Is  checked  off  by  pressing  the  line  ite-  (anywhere  on 
the  line). 

o  After  an  Item  has  been  checked  off.  It  scrolls  off  the  top  of  the 
display  and  the  next  Item  scrolls  onto  the  bottom  of  the  checklist 
area. 

o  When  an  item  reaches  the  top  of  the  display,  the  associated 
schematic  diagram  appears  below  the  checklist. 

o  Items  may  be  skipped  by  pressing  a  line  other  than  the  one  at  the 
top.  Thus,  all  lines  above  the  chosen  item  are  skipped  and  a 
message  appears  beneath  the  touch  panel  switches  which  reads 
"Checklist  Incomplete".  The  chosen  Item  moves  to  the  top  and  the 
appropriate  schematic  appears. 

o  To  recall  a  skipped  Item,  the  operator  would  press  the  "Checklist 
Incomplete"  message,  and  the  first  skipped  item  would  appear  at 
the  top  of  the  display.  All  other  Items  would  fall  Into  place 
below  the  first  skipped  item.  (The  author  did  not  mention  whether 
or  not  a  schematic  diagram  would  appear  at  this  time.) 

o  To  recall  other  skipped  Items,  the  operator  would  again  touch 
"Checklist  Incomplete".  The  next  skipped  item  would  then  replace 
the  previously  chosen  skipped  Item  at  the  top  of  the  display. 

o  This  sequence  would  continue  until  the  last  skipped  item  was 
chosen,  then  begin  again  with  the  first  skipped  item. 

o  When  an  Item  Is  checked  off  after  having  been  called  up  through 
the  "Incomplete  checklist"  mode,  the  system  reverts  to  normal 
operation. 

o  A  "Clear  Checklist"  (cLr)  switch  Is  provided  on  the  touch  panel. 
When  pressed.  It  clears  all  remaining  items  from  the  display  and 
the  checklist  sequence  continues. 

o  As  each  checklist  Is  completed,  the  next  procedure  In.  the  sequence 
automatically  appears  on  the  display.  To  display  an  out-of¬ 
sequence  procedure,  the  operator  would  press  the  Index.  (INOX) 
button  to  see  a  list  of  potential  checklists.  A  checklist  would 
be  chosen  by  pressing  the  name  of  the  desired  procedure. 

o  If  the  operator  wants  to  see  the  index  of  abnormal  or  emergency 
checklists,  the  ABN  or  EMER  button  must  be  pressed  befoe  touching 
INDX. 
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ABNORMAL  PROCEDURE  CHECKLIST  OPERATION 

o  When  a  malfunction  occurs  which  provides  an  alerting  message  and 
has  a  checklist  stored  In  memory,  pressing  the  appropriate  ABN  or 
EMER  button  automatically  displays  the  correct  checklist  and 
schematic  diagram. 

o  Once  a  checklist  has  been  begun,  the  operator's  position  will  be 
maintained  If  the  checklist  Is  Interrupted  for  any  reason.  Thus, 
If  the  operator  Is  oerformlng  a  normal  procedure  and  a  malfunction 
occurs,  the  ABN  or  EMER  switch  would  be  pressed  to  call  up  the 
malfunction-correction  procedure.  After  completion  of  said 
procedure,  the  operator  could  press  the  NORM  switch  and  return  to 
the  most  previous  position  In  the  normal  checklist. 

o  The  Reverse  (REV)  and  Advance  (ADV)  switches  move  displayed  items 
up  or  down  within  a  checklist  or  Index,  three  Items  at  one  time. 
When  at  the  end  of  the  list,  one  button  push  moves  each  Item  one 
at  a  time.  These  switches  access  procedures  In  sequence;  thus, 
after  the  operator  reaches  the  end  of  ore  checklist,  the  next 
checklist  can  be  accessed  by  pressing  ADV. 

o  To  activate  a  checklist  using  voice  commands,  the  operator  would 
press  the  voice  command  switch  (located  on  the  joystick)  and  say 
the  name  of  the  desired  procedure.  The  requested  checklist  would 
then  appear  on  the  display,  and  operate  as  described  above. 

A310  Electronic  Centralized  Aircraft  Monitor  (ECAM),  page  17 

During  normal  operation,  the  left  CRT  shows  a  memo  list  which  reminds 
the  crew  of  systems  or  functions  that  are  in  use,  enabling  significant 
Items  to  be  checked  without  the  need  to  scan  the  overhead  panels.  Flight 
phase  Mformatlon  is  presented  automatically.  System  Information  is  pre¬ 
sented  In  synoptic  format  whenever  possible.  Figure  A-3  shows  the  normal 
displays  for  the  ENGINE  START  phase  of  flight. 

When  a  failure  Is  detected  by  the  flight  warning  computer,  the  left 
display  provides  an  explicit  description  of  the  failure,  and  It  Is  colo* 
coded  In  either  red  or  amber,  according  to  the  fault  level.  The  right 
display  automatically  presents  the  proper  system  synoptic.  An  example  Is 
presented  In  Figure  A -4. 


A-6 


Figure  A-3  ECAM  Normal  Displays  for  Engine  Start 
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Figure  A -4  E CAM  Hydraulic  Failure  Displays 


The  generating  failure  (system-level  fault  to  which  crew  Is  alerted) 
Is  presented  alone  on  the  first  page  of  the  left  display.  Any  consequen¬ 
tial  failures  (faults  which  come  about  as  a  result  of  the  generating  or 
primary  failure)  are  presented  on  the  second  page  and  will  only  appear  If 
resolution  of  the  generating  failure  Is  not  successful.  Transition  from 
the  first  to  the  second  page  Is  made  by  selecting  the  CLEAR  key.  If 
simultaneous  failures  occur,  they  are  presented  according  to  a  defined 
priority  order. 

As  often  as  possible,  corrective  actions  are  presented  adjacent  to  the 
failure  description.  Crew  actions  appear  In  cyan.  Once  corrective  actions 
are  performed  and  sensed  by  the  flight  warning  system  the  cyan  Instructions 
turn  to  white.  Items  performed  automatically  (by  the  system)  and  requiring 
no  crew  action  are  displayed  In  white.  If  an  action  eliminates  the  prob¬ 
lem,  the  line  Is  deleted  after  the  action  Item  has  been  completed.  The 
action  code  Is  given  In  checklist  style  and  only  one  Item  is  presented  on 
each  line.  Each  time  a  failure  results  In  a  flight  envelope  limitation, 
the  limitation  Is  Indicated  In  cyan  adjacent  to  the  failure  description. 

Upon  selection  of  the  CLEAR  key,  a  status  page  appears  which  shows  an 
operational  summary  of  the  aircraft  condition,  the  status  of  failures  which 
affect  the  flight  operations,  and  clean-up  procedures.  The  status  page  may 
be  recalled  anytime  during  flight  by  selecting  the  STATUS  key. 

After  all  action  Items  pertaining  to  the  generating  failure  have  been 
completed,  the  crew  member  selects  the  CLEAR  key.  This  will  bring  up  any 
consequential  failures.  After  these  actions  have  been  completed,  the 
selection  of  the  CLEAR  key  will  bring  up  the  status  page,  and  selecting  the 
CLEAR  key  again  will  bring  up  the  memo  page. 

The  wording  and  abbreviations  on  the  left  display  are  consistent  with 
the  overhead  panel.  Lines  which  begin  with  conditional  statements  are 
shown  In  cyan  and  begin  with  a  decimal  point.  Status  Information  appears 


In  green  If  the  system  Is  operational,  and  In  amber  or  red  (according  to 
fault  level)  If  the  system  Is  non-operatlonal.  Memo  Items  are  presented  In 
green  (see  Figure  A-5). 

There  are  fourteen  synoptic  displays  on  the  right  CRT.  These  use 
simplified  schematics  to  show  the  arrangement  of  system  components.  Color 
coding  Is  used  to  Indicate  the  status  of  the  system.  Quantitative  infor¬ 
mation  Is  presented  by  either  numeric  displays  or  analog  scales.  Abbrevi¬ 
ations  are  used  to  identify  components.  These  displays  will  appear  auto¬ 
matically  when  an  associated  failure  occurs,  and  may  be  called  up  manually 
by  selecting  the  appropriate  key  on  the  display  control  panel. 


When  a  failure  occurs,  the  right  CRT  automatically  changes.  The 
failure  Is  listed  In  the  alert  list,  the  memo  display  changes  to  show 
procedures  and  aircraft  limitations,  and  the  flight  phase  display  changes 
to  the  applicable  system  schematic. 

The  alert  list  contains  fourteen  lines.  Alerts  are  prioritized  ac¬ 
cording  to  fault  level  and  color  coded.  A  cursor  Is  used  to  Identify  which 
procedures  and  schematics  are  being  displayed.  As  the  actions  are  com¬ 
pleted  and  the  alert  conditions  no  longer  exist,  the  message  Is  removed 
from  the  list. 

When  an  alert  occurs,  both  the  procedure  and  limitations  affecting 
aircraft  operation  are  presented  automatically.  The  procedure  Includes 
crew  actions  required,  and  actions  completed  by  the  system.  The  procedures 
are  divided  Into  primary  actions  (which  are  actions  affecting  the  safe 
operation  of  the  aircraft)  and  secondary  actions  (which  are  cleanup  proce¬ 
dures  to  protect  the  equipment).  For  a  “level  3“  (e.g.,  warning-level) 
alert  the  primary  procedures  as  well  as  the  operational  limitations  for  the 
current  flight  phase  are  presented.  For  a  "level  2"  (e.g.,  caution-level) 
alert  the  operational  limitations  affecting  the  current  flight  phase  are 
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presented.  For  either  alert  the  secondary  procedures  are  presented  below 
the  primary  procedure  or  on  a  second  page  (see  Figure  A-6). 

All  action  items  must  be  addressed  by  the  pilot.  Some  items  (such  as 
SET  actions)  can  be  sensed  by  the  system,  and  change  color  after  comple¬ 
tion.  Other  (such  as  CHECK  Items)  cannot  be  sensed,  and  remain  the  same 
color  throughout  procedure  completion.  An  asterisk  precedes  each  Item  of 
this  type. 

After  completion  of  all  procedures,  the  status  page  is  presented 
automatically  (see  Figure  A-7).  The  status  display  contains  all  current 
and  potential  aircraft  limitations,  outstanding  procedures  for  later  flight 
phases,  ar.d  operationally  significant  modifications  of  aircraft  systems. 

When  an  abnormal  procedure  is  displayed,  the  flight  phase  display 
automatically  changes  to  show  the  associated  system  schematic.  This 
schematic  duplicates  the  overhead  panel  as  much  as  possible  and  is  color 
coded  according  to  fault  level.  The  displays  are  Interactive  and  reflect 
the  actual  system  configuration  to  the  extent  practical.  This  display 
remains  until  the  FLIGHT  PHASE  key  Is  selected.  These  displays  maybe 
selected  manually  by  pressing  the  appropriate  key  on  the  MFD  control  panel. 

In  summary,  after  an  alert,  the  pilot  Is  directed  to  review  the  pro¬ 
cedure,  the  backup  procedure,  and  the  aircraft  status  information  pertain¬ 
ing  to  the  current  aircraft  status.  The  pilot has  the  capability  to  page 
through  the  information  pages  and  to  recall  information.  The  pilot  may 
continue  to  page  through  the  abnormal  procedure  loop,  and  when  all  items 
have  been  satisfactorily  addressed,  he  leaves  the  procedure  by  pressing  the 
PLIGHT  PHASE  key.  At  any  time,  the  pilot  may  select  the  STATUS  key  and  the 
status  page  will  return.  If  he  selects  the  FLIGHT  PHASE  key  without  com¬ 
pleting  the  abnormal  procedure,  the  memo  list  will  Indicate  status.  Upon 
selecting  the  STATUS  key,  the  status  page  will  contain  the  outstanding 
procedural  Items.  . 


Figure  A  -6  MFD  Secondary  Procedure  end  Display  (Gallon  and  Currin,  1 984) 


Figure  A -7  MFD  Status  Page  (Gallon  and  Currin.  1 984) 


Pfauth  and  Priest  (1981),  page  21 

Touch  screen  design  considerations: 

1.  Dialogue  development/Menu-hlerarchy 

2.  Feedback  (auditory,  visual  or  tactile?) 

3.  Size  of  target  (recommend  22  mm) 

4.  Shape  and  color  coding 

5.  Distance  between  controls  (depends  on  application) 

,  6.  Activation  force  required 

7.  Time  delay  between  touches 

8.  Mode 

9.  Resolution  required  for  task 

10.  Potential  parallax  problems 

11.  Display  size 

12.  Reliability 

In  addition,  the  following  work-place  considerations  exist:  tempera 
ture  and  humidity;  electromagnetic  field  Interference;  dirt  and  grease; 
reach  distance  and  fatigue. 
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PILOT  QUESTIONNAIRE  AND  INSTRUCTIONS 


Pilot  Questionnaire 

Note:  This  study  Is  designed  to  assess  the 

advantages  and  disadvantages  of  the 
Flight  Status  Monitor  concept  for 
possible  use  In  commercial  aviation. 
All  information  you  give  on  this 
form  will  be  kept  confidential  and 
will  be  summarized  statistically 
with  the  data  from  other  question¬ 
naires. 


Leave  Blank 
Subj.  assigned  code: 


Exp.  Ho.: 
BOT: 

EOT:  • 
Vis.  Tests; 
Form  Compl . 


(Please  Print  all  answers) 

Name:  ’ _  , _ ■ _ 

Address: _ _ _ _ 

Phone  (office  pref.)  (  ) _ Blrthdate: _ _ 

Do  you  wear  glasses/contacts  while  flying?  yes  no  (circle) 

If  you  have  no  military  experience  skip  question  la.  -  Id. 

staMsmsastiiasiiiaaissswamsstBHSssussaaM'ussMsssiaasxaassiasssssssssssss 

la.  Military  Background:  Branch  _ ,  _ , 

b.  Did  you  receive  military  pilot  training?  yes  no  (circle) 

c.  List  aircraft  types  in  which  you  trained  (If  applicable  -  otherwise  leave 

blank) 

1st _  2nd _  . 

3rd _ _ _ _  4  th  ' _ 

d.  List  all  aviation-related  (specialized)  training: 


(continue  oh  opposite  side  If  necessary) 

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaai 


Please  try  to  be  as  complete  as  possible  on  this  question.  Include  your  Civil  (noncommercial-private),  airline 
and  military  flight  experience  in  this  table  following  the  sample  given.  Place  a  check  in  the  small  box  for  those 
aircraft  for  which  you  hold  a  “type"  rating. 


Sample 


Aircraft 

TypWModai 


3707 


— Check  hara 
if  "typa" 

'  rated 


Crew  Petition 

Pilot 

Copilot 

Inetrument 

Flight 

Engineer 

Other 

Hi* 

300 

zrso 

/ZOOx 

Date 

X - 1 

/ 

\C_ 

■  Check  on*  for  '-From/To- 
C  -  CivH 
a  -  airline 
'  m  -  mattery 


tneert  total  hr»  at  top  of  - 
box 


tv  •  rrrr  »:«■.«  r»t  rm  »y-.v>i  ■!»  ?rr  r.  *■:  vc  s_thi» 


2.  a  Total  hours  flown  (approx.)  2b.  Years  flying  since  solo: _ 

not  Including  Flight  Engr:  _ _ 

•  *  0 

3.  Have  you  had  any  R£D  experience  as  a  member  of  a  development  project  team 
for  an  advanced  flight  deck  design? 

Yes 


If  yes,  please  describe  experience 


FSM  DISPLAY  AND  CONTROL  QUESTIONNAIRE 
INSTRUCTIONS 

Boeing,  Douglas,  and  Lockheed  are  conducting  a  study  for  the  FAA  to  develop  a 
Flight  Status  Monitor  (FSM).  This  system  will  be  designed  for  Implementation 
Into  future  ccamerclal  aircraft,  for  the  purpose  of  providing  crew  alerting 
for  non-normal  situations,  guiding  the  response  to  these  situations,  and 
giving  the  crew  feedback  as  they  respond.  The  system  will  be  flight  phase 
adaptive  and  will  have  alert  prioritization  and  categorization  capabilities, 
as  well  as  the  potential  for  alert  Inhibition. 

The  team  has  constructed  several  candidate  display  and  control  systems.  These 
candidates  represent  Initial  attempts  to  develop  FSM  concepts.  As  pilot  Input 
Is  fundamental  to  the  design  of  such  a  system,  your  participation  Is  requested. 

Please  fill  out  the  following  questionnaire  as  best  you  can.  Notice  that 
after  each  question,  space  Is  provided  for  an  explanation  of  your  response. 
Please  use  this  space  (and  the  back  side  of  the  paper  If  necessary)  to  provide 
a  sufficient  amount  of  Information,  so  that  we  may  adequately  Interpret  your 
answers.  A  "yes"  or  "no"  response  Is  much  more  meaningful  when  clarified  than 
when  not. 

Thank  you  for  your  time  and  effort. 

(Examples  and  Illustrations  have  been  provided  where  It  was  felt  clarification 
was  necessary.  If  you  have  any  questions,  please  contact  Don  Hanson  or  George 
Boucek  at  (206)  655-8626/2008. 


The  guidance  and  feedback  functions  6f  the  Flight  Status  Monitor  are  performed 
by  the  procedures  and  status  displays  .and  their  associated  controls.  The 
following  questionnaire  will  be  directed  toward  these  three  topics. 

I.  Procedures  Display 

The  purpose  of  this  display  Is  to  provide  the  flight  crew  with  step-by-step 
procedural  Information  which  will  permit  them  to  respond  to  non-ncrmal 
situations.  This  display  will  have  the  capability  of  providing  Information 
that  Is  currently  presented  In  the  Flight  Manual  and  Operations  Manual.  The 
procedures  display  would  also  have  the  capability  of  presenting  checklists  for 
normal  operations.  The  picture  presented  as  Figure  B-l  is  a  possible  format 
for  the  procedures  display.  Please  answer  the  following  questions  concerning 
the  display: 


LE  Sk'flTS  BSYfi 


~  •  u  i  r  v  n..  ,v  .  *. 

ALTERNAH  FLAPS  SELECTOR: ;  . .*.  ..KPPS  5 
TE  ALTERNATE  >1PP  SWITCH..  .. .'. .. ...  .OH 

SET  BUO  TO;..-.\  ......XXX  K.TS 

ALTN  FiHP  SEU^BHD  ElBP*  LEVER.  FLAPS  20 


Compared  to  the  operation  pf  using  the  Quick  Reference  Handbook  and 
Flight  Manual  for  non-normal  procedures,  rate  the  effectiveness  of  using 
a  procedures  display  to  provide  the  handbook  Information. 

_  Current  operation  much  better 

_  Current  operation  somewhat  better 

_  Both  about  the  same 

_  Procedures  Display  somewhat  better 

_  Procedures  D1 spl ay  much  better 

Comments 


Check  the  situation  In  which  the  procedures  display  should  be  used. 

_ All  non-normal  conditions 

_ Warning  level  alerts  only 

_ Warning  and  caution  level  alerts 

_  All  normal  and  non-normal  procedures 


3.  What  type  of  information  should  be  presented  on  the  procedures  display? 
(Check  all  that  apply) 

Action  Kerns  necessary  to  perform  a  procedure  (e.g. 

- THROTTLES  CLOSE  . CLOSE) 

_  Pertinent  Information  (not  a  specific  action  Item)  relevant  to  the 

situation  and  the  conduct  of  the  flight  (e.g.,  WHEN  STRUCTURAL 
DAMAGE  SUSPECTED ,  AVOID  HIGH  IAS  &  ABRUPT  MANEUVERING). 

_ An  Indication  that  the  action  Item  has  been  completed  (e.g., 

change  action  Items,  color,  or  size,  or  brightness 

_  Other  (specify) 


Comments 


4.  Should  the  procedures  display  present  procedural  Information  only 
(dedicated)  or  could  It  be  used  to  display  other  flight  Information 
(e.g.,  messages,  flight  profiles,  etc.)  when  no  procedures  are  present? 
(check  1) 


Dedicated 
Mul tl function 


Comments 


5.  How  many  procedural  steps  (action  Items)  should  be  presented  on  the 
display  at  one  time? 

_ _ One:  current  step  only 

_  Three:  current,  past  and  next  steps 

_ All  actions  for  a  procedure 

_ Other  (please  specify)  _ _ _ 


Comments 


6.  Which  of  the  following  formats  do  you  prefer  for  action  Item  presentation? 


_ PUMP  1  ON - ON 

_ PUMP  1 - ON 

_ _ TURN  PUMP  1 - ON 

_  TURN  PUMP  1  ON  — —  ON 

_  OTHER  ' 

Comments 


7.  In  general  when  should  abbreviations  be  used  In  listing  the  action  Items? 

(Check  1) 

_ Always 

_ Whenever  an  abbreviation  Is  used  on  a  particular  display,  1,t  should 

be  used  throughout  that  particular  display  to  be  consistent 

_ _  Whenever  an  abbreviation  Is  used  on  one  display.  It  should  be  used 

on  all  displays  to  be  consistent 

_  Only  when  needed  to  compress  an  action  Item  into  one  line  of  the 

display 

_  Never 

_ Other  (please  specify) _  . _ 

Comments 


8.  Referring  to  the  first  action  Item  of  Figure  B-l,  "CHECK  THE  LE  ALTN  FLAP 
LIGHT  OUT  ....  CHECK  <".  If  more  than  one  action  Item  Is  displayed  at 
one  time,  which  Indicator  should  be  provided  for  the  current  action  Item? 

_  Symbol  to  the  left  of  the  action  Item  (*>",  "*“) 

_  Symbol  to  the  right  of  the  action  Item  (">",  "*") 

,  Symbol  on  both  sides  of  the  action  Item  (">",  "*“) 

_ _ _  Color  code  the  action  Item 

Brightness  code  the  action  Item 

_ Flash  the  action  Item 

_ _  A  combination  of  the  above,  specify  • 

No  Indication  Is  required 

Other 


Comments 


How  should  the  crew  be  provided  feedback  that  an  action  Item  has  been 
completed?  (Rank  the  following  methods  from  1  to  7  with  1  being  the  most 
preferred  and  7  being  the  least  -  mark  an  “x"  beside  the  ranks  for  those, 
methods  you  consider  unacceptable) 

_  Completed  Items  removed  from  screen 

_ Completed  Item  different  color 

_ Completed  Item  different  size 

_  Place  a  symbol  (">"  or  etc.)  In  front  of  completed  Items 

_ Completed  Items  Indented  two  spaces 

Message  changes  for  completed  Item  -  e.g.,  pump  1 . on 

to  pump  1  on 

_  Combination  of  above 

_ _  Feedback  not  necessary 

_ Other  (specify) _ _ _ _ 

If  changing  color  were  used  to  Indicate  the  completed  Items,  which  Is 
more  appropriate? 

_ Green  for  completed  Items,  white  for  Incompleted  ones 

_ White  for  completed  Items,  green  for  Incompleted  ones 

for  completed  Items  for  Incomplete  ones 

- (fflT  InT  TFm  TnJ - 


Continents 


10a.  If  the  procedure  Is  too  long  to  be  presented  on  one  page,  how  should 
multiple  pages  be  Indicated? 

_ _  Symbol  at  bottom  left  of  each  page  ("  ") 

_ _  Symbol  at  bottom  right  of  each  page  {“  -) 

_  Page  number  at  top  right  of  each  page  ("2  of  4") 

Page  number  at  bottom  right  of  each  page  (“2  of  4") 

_ Word  at  bottom  left  of  each  page  (“continued-,  "more") 

Word  at  bottom  right  of  each  page  (e.g.,  “continue-, 

“more-? 

_  Indication  Is  not  necessary 

_ Other  (please  specify)  . _ 

Comments 


10b.  If  the  procedure  Is  too  long  to  be  presented  on  one  page,  should 
provisions  be  made  to  permit  the  crew  to  read  and  page  through  the 
checklist  before  taking  any  action? 

_ Yes  It  Is  absolutely  essential 

_  It  would  be  a  benefit  but  it  Is  not  necessary 

_ No,  It  Is  not  needed 


Comments 


11.  Should  voice  messages  be  used  to  present  action  Items?  (e.g.,  "THROTTLE 
CLOSE"  or  "THROTTLE")  Check  as  many  as  appropriate. 

•  a.  Voice  messages  should  be  used: 

As  the  sole  source  of  Information 

_ _  In  combination  with  the  visual  display 

!  _ Upon  crew  command  by  a  dedicated  switch 

_ Automatically,  after  cancellation  of  the  master  caution  and 

warning  switch 

j  _ Automatically,  after  the  completion  of  each  action  Item 

Never;  voice  messages  should  not  be  used  to  present  action 
1  terns 

b.  If  voice  messages  are  used,  they  should  be: 

•  _ Repeated  automatically  at  specified  time  Intervals 

_  Repeated  upon  crew  request 

_ Other  (please  specify)  • _ _ 

I  Comments 


12.  Which  of  the  following  presentation  formats  should  be  used  to  present 
voice  messages? 

_ "TURN  PUMP  2  OFF" 

"PUMP  2  OFF" 

_ ' _ "PERFORM  STEP" 

_ The  voice  message  should  match  the  visual  message  whatever  It  Is. 

— — -  Other 
Comments 


13. a.'  How  should  the  procedures  display  be  called  up  {l.e..  Initiate  action 
Item  presentation,  move  to  successive  pages,  and  clear  the  display)? 
(Check  as  many  as  are  appropriate.) 

(See  Figure  B-2) 

_ Automatically,  when  an  alert  first  appears  on  the  alerting 

alphanumeric  display 

_ Automatically,  after  cancellation  of  the  master  caution  and 

warning  switch 

_ _  Automatically,  for  warning  alert  and  manually  for  other 

alerts 

_ Manually,  by  pressing  a  line  select  key  on  alerting 

dl  spl  ay 

Manually,  by  pressing  a  line  select  key  and  then  pressing 
the  "PROCEDURES"  OR  "CHECKLIST"  key  on  a  dedicated 
keyboard 

_ Other  _ _ _ _ 

b.  How  should  the  crew  interact  with  the  procedures  display?  (This  does 
not  Include  performing  the  action  Items.) 

_ __  By  voice  command 

_ By  touching  the  display  surface 

By  pressing  dedicated  keys  adjacent  to  the  action 
1  tem 

_  By  usl ng  a  separate  keyboard 

Coanents  - 


14. a.  If  the  crew  is  in  the  middle  of  a  checklist  for  a  caution  or  advisory- 
level  alert,  and  another  alert  occurs,  how  should  the  incompleted 
checklist  be  handled?  (Assume  the  new  alert  is  the  same  alert  level) 

Remove  and  store  the  current  checklist  and  display  the  new 
checklist 

Oi splay  the  current  checklist  until  it  is  complete  and  then 
display  the  new  one 

_  Display  both  checklists  with  the  current  one  at  the  top  of  the 

display  and  the  new  one  on  the  bottom 

Display  both  checklists  with  the  current  one  on  the  bottom  of  the 
display  and  the  new  one  on  the  top 

__ _ Have  the  new  checklist  Integrated  with  the  current  checklist.  The 

Integrated  checklist  Items  would  be  rank-ordered  by  criticality. 

_ _ Other  (Specify) _  ■■ _ _ 

Comments _ . 


b.  What  would  your  response  have  been  if  the  new  alert  war  a 
warning-level  alert?  Mark  the  selected  response  with  a  "W". 

15.  Should  the  procedures  display  be  cleared  automatically  after  the  last 
action  has  been  performed,  or  should  the  crew  be  required  to  manually 
clear  the  display? 

_ Automatically 

_ Manually  by  crew 


Comments 


After  an  alert  Is  signalled,  and  perhaps  simultaneously  with  the  display 
of  procedures,  there  are  a  number  of  pieces  of  Information  that  can  be 
presented.  Mark  the  following  In  the  order  you  would  like  to  see  them  # 
(1  ■  the  first  Information  needed  and  4  the  last) 

Aircraft  status  Information  (including  operational  limitations) 
which  permit  the  crew  to  assess  the  situation  with  respect  to  the 
establishment  of  proper  flight  path  and  airplane  configuration. 

System  status  Information  permitting  the  crew  to  evaluate  the 
system  that  caused  the  alert  and  its  potential  effect  on  the 
flight. 

_ Procedural  status  Information  providing  the  crew  a  graphic  repre¬ 
sentation  of  the  subsystem  component  which  will  be  manipulated  by 
the  first  action  Item  on  the  procedures  display. 

_ A  combination  of  the  above  (please  specify)  _ _ 


Comments 


II.  Status  Displays 

The  purpose  of  the  status  display  is  to  provide  the  crew  with  feedback  . 

concerning  the  present  status  of  the  flight  and  the  aircraft  and  its 

systems.  The  information  presented  on  this  display  encompasses  a  number 

of  levels  of  information. 

o  Aircraft  Status  -  Provides  an  overall  indication  of  aircraft  status 
including  the  operability  of  all  control  surfaces,  engines,  flight 
controls,  landing  gears,  etc.  In  addition,  alphanumeric  informa¬ 
tion  describing  the  impact  of  degraded  system  capability  will  be 
provided  (i.e.,  operational  limits,  diversions,  environmental  con¬ 
straints,  policy,  etc.)  Figure  B-3  presents  an  example  of  an  air¬ 
craft  status  display. 

o  Failed  System  Status  -  provides  a  representation  of  the  system  that 
has  produced  the  alert  situation.  The  information  presented  about 
t^e  system  would  include  switch  and  valve  position,  operation 
parameters  of  the  system  (flows,  temperature,  pressures,  etc.)  and 
malfunctioning  components.  Figure  B-4  is  an  example  of  the  Failed 
System  Status  Display. 

o  Procedural  Status  -  as  the  procedural  action  items  (checklist)  are 
being  performed,  the  crew  may  interact  with  various  aircraft 
systems  or  system  components.  The  procedural  status  display  pro¬ 
vides  the  crew  a  representation  of  the  system  or  system  component 
being  addressed  by  the  action  item  being  worked.  Figure  B-5 
presents  an  example  of  this  display. 

o  Information  -  the  lowest  information  level  of  the  status  display 
present  the  supplementary  information  currently  found  in  the 
handbook.  Figure  B-6  is  an  example  of  this  display. 

Please  answer  the  following  questions  concerning  the  status  display. 

A.  Aircraft  Status  Display 

1.  How  Important  do  you  feel  it  is  to  provide  the  aircraft  status  for 
alerts? 

_  Necessary 

•  Beneficial 

_  Not  needed 

■  Hay  have  negative  effect 
Unacceptable 


Comments 
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L  ENG  ftNTif-  ICE 


ICING  CONDITIONS  EXIST;  fOTAL  AIR 
TEMPERATURE-  IS.  BELOW  10  DEG.  C. 


ICING  CBN*  OCCUR  WHEN* 

VISIBLE  MOISTURE  IN  BNY  FORM  IS 


PRESENT  SUCH  AS  FOG  WITH  VISIBILITY 
LESS  .THAN  ONE  MILE.  ’  RAIN.-;  SNOW.  > 
SLEET.  •  ICE  CRYSTALS. ,  ETC.  - 


Tce  BUILDUP  MAY  RESULT  IN  severe 
"  '  ENGINE i DAMAGE ; AND/OR  FLAMEOUT 

ERRATIC.  EP.R  INDICATONS  OR  ABNORMAL  • 
‘ ..  EPR  RELATIVE  TO  N1  MAY  BE  AN 

.  indication-  of.  Engine  icing 


2.  What  Information  should  be  presented  on  the  aircraft  status 

display?  (Check  all  that  are  appropriate.)  (Refer  to  Figure  B-3) 

System  faults  (e.g.,  failed  hydraulic  pump  or  failed 
generator,  etc.) 

_  Operational  status  of  the  Comm/Nav.  Equipment  (l.e.,  radios, 
guidance  equipment,  etc.) 

_ Operational  status  of  landing  gear,  brakes,  steering  tires, 

etc. 

_ __  Operational  status  of  the  engines 

_ Operational  status  of  flight  control  surfaces  (l.e.,  flaps, 

stats,  rudder,  etc.) 

_ Operational  limits  (l.e.,  speed  limits,  diversions, 

environmental  constraint,  policy,  etc.) 


Comments 


3.  Which  mode(s)  of  preseritatlon  should  be  used  to  show  aircraft 
status? 


Written  list  (e.g.,  operational  limits,  diversions.,  etc.) 

_ Pictorial  outline  of  aircraft  and  pictorial  representation  of 

the  systems  as  shown  In  Figure  B-3i 

Combination  of  the  above 

_  Other  ■  '  ■ 

Comments _ _ 


How  should  Information  be  coded  or  formatted  on  the  aircraft  status 

display?  (Check  all  that  are  appropriate) 

_  System  symbols  or  characters  should  be  color  coded  according  to 

alert  urgency  level  generated  by  the  failure  condition 

_  System  symbols  or  characters  should  be  brightness  coded  according 

to  alert  urgency  level  generated  by  the  failure  condition 

_  System  symbols  or  characters  should  be  color  coded  according  to 

operational  status  using  colors  other  than  those  used  for  crew 
alerting  (red  and  amber  may  not  be  used) 

System,  symbols  or  characters  should  be  brightness  coded  according 
to  operational  status 

_ Symbol,  shape,  or  written  messages  should  be  used  to  Indicate 

operational  status 

_ Quantitative  information,  (l.e.,  operational  limits)  should  be 

presented  In  analog  form  (e.g.,  speed  limit  bars,  flap  limit 
drawing,  etc.) 

_  Quantitative  Information  should  be  presented  in  digital  form 

Other 


Comments 


How  and  when  should  the  aircraft  status  display  be  activated?  (Check 
all  that  apply) 

_ Automatically,  at  flight  phase  change 

_ Automatically,  when  the  alert  occurs 

Automatically,  when  the  procedure  display  Is  activated 
Automatically,  at  the  completion  of  the  fault  procedure 

_ Manually  by  pressing  a  switch 

_ Manually  by  voice  command 

Comments _ . 


System  Status  Displays  (Falled-System  and  Procedures  System  Status) 


l.a.  How  Important  Is  the  failed  system  status  display  In  assessing 
system/aircraft  condition?  (Refer  to  Figure  B-4) 

_ Absolutely  necessary 


Beneficial 
Not  needed 

May  have  a  negative  effect 


Totally  unacceptable 

b.  How  Important  Is  the  procedural  systems  status  display  In 
performing  the  non-normal  procedures  for  alerts?  (Refer  to 
Figure  B-5) 


_ Absolutely  necessary 

Beneficial 
•  Not  heeded 

May  have  a  negative  effect 
Totally  unacceptable 
Comments  • _ 
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7.'  Hhat  should  be  presented  on  a  systems  display?  Nark  all  that  are 
appropriate.  (Use  an  “F"  for  those  that  are  appropriate  for 
falled-system  status  and  a  “P“  for  those  appropriate  for 
procedural  status) 

_ Operational  status  of  the  system  components,  l.e.,  position 

of  switches,  state  of  pumps,  etc. 

_ Quantitative  parameters,  l.e.,  temperatures,  pressures, 

levels,  flow  rates,  etc. 

_ _  Faulted  components 

_ Trend  Information,  l.e.,  near  limiting  condition  and 

abnormal  rates 

_ Other _ '  _ . 

Comments 


I 


i 

•m 


8.  Should  the  falled-system  status  display  provide  greater  levels  of 
detail  upon  demand? 

_ _  Yes 

_ No 

Comments 


t 


r 


i 


9,  What  type  of  presentation  should  be  used  for  system  status? 
_ Written  lists 

_  Schematic  diagrams,  as  Illustrated  In  Figures  B-4  and  B-5 

Pictorial  representative 
Combination  of  the  above.  Specl fy 


Comments 
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How  should  the  system  status  Information  be  coded  or  formatted? 
(Check  all  that  are  appropriate.) 

Symbol  or  character  color  coded  according  to  alert  urgency 
level  generated  by  the  failure condition 

Symbol  or  character  brightness  code  according  to  alert 
urgency  level  generated  by  the  failure  condition 

Symbol  or  character  color  coded  according  to  operational 
status  using  colors  other  than  those  used  for  crew  alerting 
te.g.,  red  and  amber  may  not  be  used) 

Symbol  or  character  brightness  coded  according  to  opera¬ 
tional  status 


Symbol,  shape,  or  written  message  which  change  according  to 
operational  level 

Quantitative  Information  displayed  on  an  analog  scale  (e.g., 
speed  limit  bars,  flap  limit  drawing,  etc.) 

Quantitative  Information  displayed  digitally 

Other 


Comments 


-V 


11.  How  should  the  crew  Interact  with  the  status  display  (e.g.,  system 
selection,  paging,  and  erasing)? 

_ Dedicated  switch(s)  on  the  display-control  panel 

_ Multifunction  swltch(s)  on  a  multifunction  control  panel 

_ A  touch  panel  overlay  on  the  status  display 

Voice  command 


Comments 


III.  System  Controls 


Six  candidate  concepts  for  FSM  design  have  been  developed.  The  FSM 
concepts  differ  In  their  level  of  automation:  manual,  system  aided  and 
automatic.  There  are  two  FSM  display-control  concepts  under  the  manual 
category:  1)  manual  display  callup  after  an  alert  and  2)  automatic 
display  callup  after  an  alert.  With  the  manual  method,  aircraft  system 
reconfiguration  Is  accomplished  on  the  systems  overhead  panel.  The. 
systems  aided  concepts  Include  automatic  display  callup  and  the  aircraft 
systems  are  controlled  by  Innovative  concepts  In  conjunction  with  the 
FSM  displays  Including  voice  Interaction,  touch  panel  overlays,  and  a 
multifunction  keyboard.  The  last  concept  Is  automatic  reconfiguration 
which  only  requires  the  crew  to  give  a  go-ahead  signal.  This  concept 
may  be  used  In  conjunction  with  any  of  the  above  concepts,  but  for  this 
study  It  was  Implemented  only  In  the  multifunction  keyboard  concept. 
These  concepts  are  described  In  more  detail  in  the  following  paragraphs. 

Basic  Concept 

The  operation  of  the  Basic  concept  Is  as  follows.  After  an  alert 
occurs,  the  crew  cancels  the  master  caution  and  warning  Indicator  and 
reads  the  alert  display  to  Identify  the  fault.  By  pushing  the  line 
select  and  CHECKLIST  keys,  the  alert  procedure  Is  displayed  on  the 
procedures  display.  If  the  crew  pushes  the  STATUS  key,  the  aircraft 
status  Is  presented  on  the  status  display.  By  selecting  the  STATUS  key 
again,  the  FSM  will  display  the  system  with  the  first  procedural  action 
Item. 

The  crew  reads  the  checklist  arid  performs  the  necessary  actions  on  the 
overhead  panel.  If  there  Is  more  than  one  page  of  procedures,  the  com¬ 
pletion  of  the  Items  on  the  first  page  will  bring  up  the  next  page.  By 
pushing  the  CHECKLIST  key  In  rapid  succession  the  crew  may  step  through 
the  procedure  pages.  After  the  procedures  are  completed,  the  crew  ma; 
step  through  the  status  pages  by  pushing  the  STATUS  key.  After 
completion  of  the  checklist  procedures,  the  displays  will  be  cleared. 

The  alert  message  Is  removed  from  the  alert  display  after  the  alerting 

•  , 
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situation  no  longer  exists,  otherwise  It  may  be  cleared  by  line 
selecting  the  alert  and  selecting  STORE. 

Basic  Concept  with  Automatic  Display 

Thl s  concept  1 s  the  same  as  the  above  concept  except  when  the  crew 
pushes  the  line  select  key,  the  procedures  arid  status  displays  will  be 
brought  up  automatically.  As  the  crew  completes  all  the  ac<<ons  on  a 
page,  the  next  page  will  appear  automatically.  After  the  procedures  are 
completed  the  crew  may  step  through  the  remaining  status  pages. 

Touch  Panel  Interactive  Concept 

In  this  concept,  the  procedures  display  and  status  display  (aircraft 
status  page)  are  called  up  by  the  pilot  selecting  the  line  address  key 
on  the  alert  display.  The  pilot  performs  the  actions  directly  on  the 
status  display  by  using  a  touch  sensitive  surface.  After  stepping  past 
the  aircraft  status  page,  the  status  display  will  Contain  a  schematic 
representation  of  the  first  action-item  system  with  computer  generated 
touch  keys  to  reconfigure  the  system.  Feedback  Information  Is  presented 
on  both  the  procedures  and  status  displays.  Each  action  Item  will  have 
a  corresponding  schematic  diagram  on  the  status  display.  This  display 
Is  also  touch  Interactive  for  calling  up  more  detailed  Information,  If 
desired. 

Voice  Interactive  Concept 

This  concept  uses  voice  for  both  messages  and  control  of  the  displays 
and  aircraft  systems.  Voice  control  actuation  Is  optional,  and  both  the 
displays  and  systems  may  be  manually  controlled  as  described  under  the 
Basic  or  Touch  Interactive  concepts.  Voice  messages  are  used  to  direct 
the  crew's  attention  to  alerts  and  to  the  actions  to  be  performed  If  the 
alert  Is  a  time-critical  alert. 

After  pushing  the  line  select  key,  the  pilot  nay  select  voice 
Interaction  by  depressing  the  voice  key.  Aftur  the  displays  are  called 
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up,' the  crew  would  select  the  first  action  Item  by  saying  "next"  and  the 
first  action  Item  would  be  annunciated.  If  the  crew  wants  the  message 
repeated  they  would  say  "repeat".  To  execute  an  action  Item,  the  crew 
says,  for  example,  "pump  1  off"  and  the  action  Is  completed.  The  crew 
continues  this  process  until  all  the  procedures  are  completed.  Feedback 
Is  presented  visually  on  the  procedures  and  status  displays  and  may  be 
presented  by  voice  messages.  After  the  procedures  are  completed  a  voice 
message  Is  given  to  that  affect. 

Multifunction  Keyboard  Concept 


This  concept  uses  a  multifunction  keyboard  with  programmable  keys  and  a 
scratchpad.  The  scratchpad  display  presents  the  alert  procedures.  Air¬ 
craft  status  Is  provided  on  the  status  display.  The  multifunction 
keyboard  presents  the  sequence  of  control  actions.  This  concept  has 
also  been  termed  "Directed  Selection"  because  the  multifunction  keys  can 
be  programmed  to  present  the  sequence  of  actions  to  be  taken  by  the  crew. 

The  operation  shows  that  after  selecting  the  alert,  the  action  Items 
appear  on  the  scratchpad.  The  actions  that  are  Interactive  with  the 
aircraft  systems  are  presented  In  sequence  on  the  multllegend  keyboard. 

To  perform  the  action  Items,  the  pilot  must  depress  the  corresponding 
multifunction  key.  This  procedure  Is  continued  until  all  Items  are 
completed.  Feedback  Is  provided  on  the  scratchpad  and  on  the 
mul tl f uncti on  1 egends . 

Automatic  Reconfiguration  Concept 


Any  of  the  systems  aided  concepts  could  Incorporate  pilot-initiated  auto¬ 
matic  system  reconfiguration.  For  demonstration  purposes,  the  multifunc¬ 
tion  keyboard  concept  was  used  to  evaluate  the  feasibility  of  this 
control  method.  This  concept  requires  the  same  steps  to  call  up  the 
scratchpad  display.  However,  the  crew  has  only  to  select  one  key  to  . 
Initiate  the  corrective  action.  Action  and  stctus  feedback  are 
presented  upon  the  scratchpad  display.  The  crew  has  the  option  to  stop 
the  reconfiguration  at  any  time. 


1 ne  following  questions  concern  the  method  the  crew  uses  to  interact 
with  the  Flight  Status  Monitor. 


1.  Rank  order  each  concept  of  performing  the  action  Item  according  to  each 
of  the  following  criteria.  Place  a  “1"  next  to  the  most  preferred 
concept  and  "5"  next  to  the  least  acceptable  concept  for  each  criteria. 


•  Concept 
dedicated 


Ease  of 
Use 


Probability:  Ease  of 
of  Error  :  Training 


Overall 

Operability 


Overall 

Desirability 


System  Panel 

Multifunction 

Keyboard 

touch  Panel 

Voice  Command 

Automatic 

Reconfiguration 


Comments 


2.  For  a  touch  panel  Interactive  system,  which  do  you  prefer? 

Touch  area  on  the  procedures  display  next  to  the  procedural  action 
Items  without  a  status  display 

Touch  area  on  the  procedures  display  next  to  the  procedural  action 
Items  with  a  status  display 

Touch  area  over  the  component  symbol  on  status  display,. I.e.  you 
touch  the  component  you  wish  to  change  with  a  procedures  display 

Action  Items  appearing  on  the  status  display  which  has  the  touch 
area  over  the  components  symbols  without  a  procedures  display 

Other 


Comments 


3 


If  s'ubsystem/system  panels  can  be  displayed  and  operated  via  touch 
Interactive  displays,  would  dedicated  aircraft  subsystem  control  panels 
still  be  required?  (Assume  that  sufficient  redundancy  is  provided  to 
ensure  system  reliability) 

_  Yes 

_ _  No 

Comments 


4a.  Should  voice  control  be  used  as  Input  to  the  FSM? 

_  Yes  It  Is  a  necessary  component 

_  It  would  be  a  benefit  but  Is  not  necessary 

_ _  It  should  not  be  used 

_ Other _ _ 

Comments 


4b.  If  voice  control  Is  used,  which  of  the  following  configurations  do  you 
prefer? 

t  Voice  control  only 

Voice  In  combination  with  a  dedicated  systems  panel 
Voice  in  combination  with  a  multifunction  keyboard 
_______  Voice  In  combination  with  a  touch  panel 

Otter 


Comnents 


For  Which  FSM  function(s)  should  voice  control  be  used?  (Check  all  that 

apply) 


_ Calling  up  the  procedures  display 

_ Calling  up  the  status  display 

_ Cancelling  thfe  masters  alerts 

_  Selecting  alerts  for  display  of  procedures/ status 

_ Storing,  recalling  alerts 

_  Performing  procedural  action  Items 

_ Other _ _ _ 

Comments 


How  should  voice  control  be  actuated? 

Dedicated  or  multifunction  switch  on  a  display-control  panel 
(e.g..  Figure  B-2) 

_ Knee  switch 

_  Mike  switch 

_ _ Voice  command  (using  a  code  word) 

'  Always  be  active  during  operation 

Other 


Comments 


If  multllegend  keys  are  used  on  a  multifunction  keyboard  for  system 
control,  what  should  be  presented  on  the  legends? 

_  Procedure  step  number 

_  Procedure  action  Item 

_  Identification  of  system  component  requiring  reconfiguration 

_ Other _ . _ 

Comments 


If  an  automatic  reconfiguration  system  Is  used,  which  of  the  followlrg 
features  should  be  Incorporated?  (Check  all  that  apply) 

_ Capability  should  be  crew  selectable 

_ Crew  should  have  capability  to  see  previous  configuration  (After 

automatic  reconfiguration  completed) 

_  System  status  should  be  provided  after  reconfiguration 

_ Automatic  sequence  should  stop  short  of  critical  action  Item, 

(e.g.,  engine  shut  down,  gear  up/ down) 

_ Crew  should  have  the  capability  to  stop  the  automatic  sequence 

Other 


Comments 


If  you  had  the  responsibility  for  developing  an  FSM,  which  controls  and 
displays  would  you  Implement  to  provide  crew  guidance  and  status 
Information? 


Control s 


